diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-26 21:08:55 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-09-09 13:53:29 +0200 |
| commit | da5220bc06bf53725f3bfe58e384780584b7e9c0 (patch) | |
| tree | 4bd29e23114a43ee473199c3fee72bd70fc8cf79 | |
| parent | 5a76224c8826b3b7719a97e47ac9d2120a0fc419 (diff) | |
| download | ffmpeg-da5220bc06bf53725f3bfe58e384780584b7e9c0.tar.gz | |
avformat/gxf: Check pkt_len
Fixes: Infinite loop
Fixes: 26576/clusterfuzz-testcase-minimized-ffmpeg_dem_GXF_fuzzer-4823080360476672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dad9a86ca7bf912289aafb33d96980630e6ec53a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/gxf.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavformat/gxf.c b/libavformat/gxf.c index 399f745bc7..640a2bacb4 100644 --- a/libavformat/gxf.c +++ b/libavformat/gxf.c @@ -285,9 +285,12 @@ static void gxf_track_tags(AVIOContext *pb, int *len, struct gxf_stream_info *si static void gxf_read_index(AVFormatContext *s, int pkt_len) { AVIOContext *pb = s->pb; AVStream *st; - uint32_t fields_per_map = avio_rl32(pb); - uint32_t map_cnt = avio_rl32(pb); + uint32_t fields_per_map, map_cnt; int i; + if (pkt_len < 8) + return; + fields_per_map = avio_rl32(pb); + map_cnt = avio_rl32(pb); pkt_len -= 8; if ((s->flags & AVFMT_FLAG_IGNIDX) || !s->streams) { avio_skip(pb, pkt_len); |