diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-22 23:08:13 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-09-11 21:23:48 +0200 |
| commit | f7fe3969ef943bb375ac1b16e4fd5915e4096cf3 (patch) | |
| tree | 4206466d0b8964f3ec998b4294ab7598596bc69b | |
| parent | 3293cf065ec926fcd00c705b96e6f9537b3f3425 (diff) | |
| download | ffmpeg-f7fe3969ef943bb375ac1b16e4fd5915e4096cf3.tar.gz | |
avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative
These fields are not signed in the spec (1.0) so they cannot be negative
Changing bytes_per_packet to unsigned would not solve this as it is exported
as block_align which is signed
Fixes: Infinite loop
Fixes: 26492/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5632087614554112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5eed718087f2ba307a3d1d294016d2ebae9230f3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/cafdec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c index 7652d9e238..5b1abc4f47 100644 --- a/libavformat/cafdec.c +++ b/libavformat/cafdec.c @@ -79,6 +79,9 @@ static int read_desc_chunk(AVFormatContext *s) st->codecpar->channels = avio_rb32(pb); st->codecpar->bits_per_coded_sample = avio_rb32(pb); + if (caf->bytes_per_packet < 0 || caf->frames_per_packet < 0) + return AVERROR_INVALIDDATA; + /* calculate bit rate for constant size packets */ if (caf->frames_per_packet > 0 && caf->bytes_per_packet > 0) { st->codecpar->bit_rate = (uint64_t)st->codecpar->sample_rate * (uint64_t)caf->bytes_per_packet * 8 |