diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-11-12 18:14:19 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-12-23 00:43:02 +0100 |
| commit | b92260f70a4ac194d1cc09c40b92766d38c7c783 (patch) | |
| tree | cd54ecd860d48e486be2f08d67bd2086efb9f40f | |
| parent | 64c6c568908ee9d7f9a5d75686b6d4ce3334222c (diff) | |
| download | ffmpeg-b92260f70a4ac194d1cc09c40b92766d38c7c783.tar.gz | |
avformat/lafdec: Check for EOF in header reading
Fixes: OOM testcase
Fixes: 51527/clusterfuzz-testcase-minimized-ffmpeg_dem_LAF_fuzzer-5453663505612800
OOM can still happen after this as an arbitrary sized block is allocated and read
this would require a redesign or some limit on the sample rate.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/lafdec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/lafdec.c b/libavformat/lafdec.c index 12b0d8540b..d02b479c4d 100644 --- a/libavformat/lafdec.c +++ b/libavformat/lafdec.c @@ -111,6 +111,9 @@ static int laf_read_header(AVFormatContext *ctx) sample_rate = avio_rl32(pb); duration = avio_rl64(pb) / st_count; + if (avio_feof(pb)) + return AVERROR_INVALIDDATA; + switch (quality) { case 0: codec_id = AV_CODEC_ID_PCM_U8; |