diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-21 22:56:17 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-30 17:49:51 +0100 |
| commit | 3588e2e6b05ba92f0907e9ffe263c2e65d53e346 (patch) | |
| tree | cf0d34fa3bb786d68ad4c451941dd7ecbbaa2a75 /libavformat | |
| parent | d5c42b8c080920d3bbdde91ccd38cd8de0aefa05 (diff) | |
| download | ffmpeg-3588e2e6b05ba92f0907e9ffe263c2e65d53e346.tar.gz | |
avformat/iff: More completely check body_size
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/iff.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/iff.c b/libavformat/iff.c index 04fe8be4eb..fb76aed4c3 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -839,7 +839,7 @@ static int iff_read_packet(AVFormatContext *s, } else if (st->codecpar->codec_tag == ID_DST) { return read_dst_frame(s, pkt); } else { - if (iff->body_size > INT_MAX) + if (iff->body_size > INT_MAX || !iff->body_size) return AVERROR_INVALIDDATA; ret = av_get_packet(pb, pkt, iff->body_size); } @@ -875,6 +875,8 @@ static int iff_read_packet(AVFormatContext *s, pkt->flags |= AV_PKT_FLAG_KEY; } else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO && st->codecpar->codec_tag != ID_ANIM) { + if (iff->body_size > INT_MAX || !iff->body_size) + return AVERROR_INVALIDDATA; ret = av_get_packet(pb, pkt, iff->body_size); pkt->pos = pos; if (pos == iff->body_pos) |