diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-06-06 19:30:30 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-06-07 01:21:55 +0200 |
| commit | 8edfd0598d17a828cd59873351645ad1fbe8ff16 (patch) | |
| tree | 3b02c177f7abae70e8545797716b8e92f92043a5 /libavformat/oggdec.c | |
| parent | 108ee4b4a575932808fa4c80bc248fedae70e99f (diff) | |
| download | ffmpeg-8edfd0598d17a828cd59873351645ad1fbe8ff16.tar.gz | |
avformat/oggdec: Do not hardcode arbitrary and sometimes unavailable size
Fixes: regression since e983197cbc93420b67aa7e811be47d7278c2c8a2
Fixes: out of array read
Fixes: 22185/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5662069073641472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/oggdec.c')
| -rw-r--r-- | libavformat/oggdec.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavformat/oggdec.c b/libavformat/oggdec.c index f65013f55e..9eb45499c6 100644 --- a/libavformat/oggdec.c +++ b/libavformat/oggdec.c @@ -206,7 +206,7 @@ static const struct ogg_codec *ogg_find_codec(uint8_t *buf, int size) * situation where a new audio stream spawn (identified with a new serial) and * must replace the previous one (track switch). */ -static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic, +static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic, int page_size, int probing) { struct ogg *ogg = s->priv_data; @@ -220,7 +220,7 @@ static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic, } /* Check for codecs */ - codec = ogg_find_codec(magic, 8); + codec = ogg_find_codec(magic, page_size); if (!codec && !probing) { av_log(s, AV_LOG_ERROR, "Cannot identify new stream\n"); return AVERROR_INVALIDDATA; @@ -430,7 +430,7 @@ static int ogg_read_page(AVFormatContext *s, int *sid, int probing) /* CRC is correct so we can be 99% sure there's an actual change here */ if (idx < 0) { if (data_packets_seen(ogg)) - idx = ogg_replace_stream(s, serial, readout_buf, probing); + idx = ogg_replace_stream(s, serial, readout_buf, size, probing); else idx = ogg_new_stream(s, serial); |