diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-26 21:08:55 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-11-04 23:30:53 +0100 |
| commit | dad9a86ca7bf912289aafb33d96980630e6ec53a (patch) | |
| tree | 19bd4fd7623025172a7155bdda409a3332dab410 /libavformat/gxf.c | |
| parent | 0ba71a72d3a617b255b71988a000d5093222f779 (diff) | |
| download | ffmpeg-dad9a86ca7bf912289aafb33d96980630e6ec53a.tar.gz | |
avformat/gxf: Check pkt_len
Fixes: Infinite loop
Fixes: 26576/clusterfuzz-testcase-minimized-ffmpeg_dem_GXF_fuzzer-4823080360476672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/gxf.c')
| -rw-r--r-- | libavformat/gxf.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavformat/gxf.c b/libavformat/gxf.c index 96b7035386..b787d4f521 100644 --- a/libavformat/gxf.c +++ b/libavformat/gxf.c @@ -285,9 +285,12 @@ static void gxf_track_tags(AVIOContext *pb, int *len, struct gxf_stream_info *si static void gxf_read_index(AVFormatContext *s, int pkt_len) { AVIOContext *pb = s->pb; AVStream *st; - uint32_t fields_per_map = avio_rl32(pb); - uint32_t map_cnt = avio_rl32(pb); + uint32_t fields_per_map, map_cnt; int i; + if (pkt_len < 8) + return; + fields_per_map = avio_rl32(pb); + map_cnt = avio_rl32(pb); pkt_len -= 8; if ((s->flags & AVFMT_FLAG_IGNIDX) || !s->streams) { avio_skip(pb, pkt_len); |