diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-21 22:56:17 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-02-02 14:18:21 +0100 |
| commit | cd733f1c88982d870b647cca480131fcb406e090 (patch) | |
| tree | 098ebe1e4cb143a39bde193614732bd42e264cc1 | |
| parent | 7bfa801811d2a6419f44735eb4951ab58607123e (diff) | |
| download | ffmpeg-cd733f1c88982d870b647cca480131fcb406e090.tar.gz | |
avformat/iff: More completely check body_size
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3588e2e6b05ba92f0907e9ffe263c2e65d53e346)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/iff.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/iff.c b/libavformat/iff.c index 04fe8be4eb..fb76aed4c3 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -839,7 +839,7 @@ static int iff_read_packet(AVFormatContext *s, } else if (st->codecpar->codec_tag == ID_DST) { return read_dst_frame(s, pkt); } else { - if (iff->body_size > INT_MAX) + if (iff->body_size > INT_MAX || !iff->body_size) return AVERROR_INVALIDDATA; ret = av_get_packet(pb, pkt, iff->body_size); } @@ -875,6 +875,8 @@ static int iff_read_packet(AVFormatContext *s, pkt->flags |= AV_PKT_FLAG_KEY; } else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO && st->codecpar->codec_tag != ID_ANIM) { + if (iff->body_size > INT_MAX || !iff->body_size) + return AVERROR_INVALIDDATA; ret = av_get_packet(pb, pkt, iff->body_size); pkt->pos = pos; if (pos == iff->body_pos) |