diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-21 22:56:17 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-09-10 16:04:26 +0200 |
| commit | 2765860a65134b47b397f1ac03eca8c78f54cd65 (patch) | |
| tree | 5de47a401e860c3f16a7ea15ae5ce2a833fbba30 | |
| parent | 804fcfb05e0ae0f5010e0ae83059013a967cf80d (diff) | |
| download | ffmpeg-2765860a65134b47b397f1ac03eca8c78f54cd65.tar.gz | |
avformat/iff: More completely check body_size
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3588e2e6b05ba92f0907e9ffe263c2e65d53e346)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/iff.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/iff.c b/libavformat/iff.c index add8912686..4e19e21127 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -837,7 +837,7 @@ static int iff_read_packet(AVFormatContext *s, } else if (st->codecpar->codec_tag == ID_DST) { return read_dst_frame(s, pkt); } else { - if (iff->body_size > INT_MAX) + if (iff->body_size > INT_MAX || !iff->body_size) return AVERROR_INVALIDDATA; ret = av_get_packet(pb, pkt, iff->body_size); } @@ -873,6 +873,8 @@ static int iff_read_packet(AVFormatContext *s, pkt->flags |= AV_PKT_FLAG_KEY; } else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO && st->codecpar->codec_tag != ID_ANIM) { + if (iff->body_size > INT_MAX || !iff->body_size) + return AVERROR_INVALIDDATA; ret = av_get_packet(pb, pkt, iff->body_size); pkt->pos = pos; if (pos == iff->body_pos) |