diff mbox

[FFmpeg-devel,1/4] avformat/shortendec: Check k in probe

Message ID 20190925100120.12305-1-michael@niedermayer.cc
State Accepted
Commit ea770eb55941a6ed7b86828d6ea2f4e718a4b337
Headers show

Commit Message

Michael Niedermayer Sept. 25, 2019, 10:01 a.m. UTC 
Fixes: Assertion failure
Fixes: 17640/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5708767475269632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/shortendec.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

Comments

Michael Niedermayer Oct. 16, 2019, 4:20 p.m. UTC | #1 
On Wed, Sep 25, 2019 at 12:01:17PM +0200, Michael Niedermayer wrote:
> Fixes: Assertion failure
> Fixes: 17640/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5708767475269632
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/shortendec.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)

will apply

[...]
diff mbox

Patch

diff --git a/libavformat/shortendec.c b/libavformat/shortendec.c
index a2879dc5a3..f7390b2e62 100644
--- a/libavformat/shortendec.c
+++ b/libavformat/shortendec.c
@@ -40,12 +40,18 @@  static int shn_probe(const AVProbeData *p)
         channels = get_ur_golomb_shorten(&gb, 0);
         blocksize = 256;
     } else {
-        int k;
+        unsigned k;
         k = get_ur_golomb_shorten(&gb, 2);
+        if (k > 31)
+            return 0;
         internal_ftype = get_ur_golomb_shorten(&gb, k);
         k = get_ur_golomb_shorten(&gb, 2);
+        if (k > 31)
+            return 0;
         channels = get_ur_golomb_shorten(&gb, k);
         k = get_ur_golomb_shorten(&gb, 2);
+        if (k > 31)
+            return 0;
         blocksize = get_ur_golomb_shorten(&gb, k);
     }