diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-21 22:56:17 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-09-09 13:53:29 +0200 |
| commit | 36ff07fd0281f6b5b9ed6466d23b82c1e91c4906 (patch) | |
| tree | e206fe173d115a3c9303b5793fb68e8bd3ed192d | |
| parent | bb88c223d6b414cf939dc8143f41a36da332ab30 (diff) | |
| download | ffmpeg-36ff07fd0281f6b5b9ed6466d23b82c1e91c4906.tar.gz | |
avformat/iff: More completely check body_size
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3588e2e6b05ba92f0907e9ffe263c2e65d53e346)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/iff.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/iff.c b/libavformat/iff.c index aa2d9dd48c..d1c99fe9ce 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -837,7 +837,7 @@ static int iff_read_packet(AVFormatContext *s, } else if (st->codecpar->codec_tag == ID_DST) { return read_dst_frame(s, pkt); } else { - if (iff->body_size > INT_MAX) + if (iff->body_size > INT_MAX || !iff->body_size) return AVERROR_INVALIDDATA; ret = av_get_packet(pb, pkt, iff->body_size); } @@ -873,6 +873,8 @@ static int iff_read_packet(AVFormatContext *s, pkt->flags |= AV_PKT_FLAG_KEY; } else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO && st->codecpar->codec_tag != ID_ANIM) { + if (iff->body_size > INT_MAX || !iff->body_size) + return AVERROR_INVALIDDATA; ret = av_get_packet(pb, pkt, iff->body_size); pkt->pos = pos; if (pos == iff->body_pos) |