| Message ID | 20200318192044.32699-2-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [FFmpeg-devel,1/2] avcodec/siren: Fix integer overflow in get_dw() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/ffmpeg-patchwork | success | Make fate finished |
lgtm On 3/18/20, Michael Niedermayer <michael@niedermayer.cc> wrote: > Fixes: memleaks > Fixes: > 21084/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5655975492321280 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/nsvdec.c | 20 ++++++++++++++------ > 1 file changed, 14 insertions(+), 6 deletions(-) > > diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c > index 7aa1b605b0..b5d9313778 100644 > --- a/libavformat/nsvdec.c > +++ b/libavformat/nsvdec.c > @@ -211,6 +211,7 @@ static const AVCodecTag nsv_codec_audio_tags[] = { > > //static int nsv_load_index(AVFormatContext *s); > static int nsv_read_chunk(AVFormatContext *s, int fill_header); > +static int nsv_read_close(AVFormatContext *s); > > /* try to find something we recognize, and set the state accordingly */ > static int nsv_resync(AVFormatContext *s) > @@ -492,25 +493,32 @@ static int nsv_read_header(AVFormatContext *s) > nsv->ahead[0].data = nsv->ahead[1].data = NULL; > > for (i = 0; i < NSV_MAX_RESYNC_TRIES; i++) { > - if (nsv_resync(s) < 0) > - return -1; > + err = nsv_resync(s); > + if (err < 0) > + goto fail; > if (nsv->state == NSV_FOUND_NSVF) { > err = nsv_parse_NSVf_header(s); > if (err < 0) > - return err; > + goto fail; > } > /* we need the first NSVs also... */ > if (nsv->state == NSV_FOUND_NSVS) { > err = nsv_parse_NSVs_header(s); > if (err < 0) > - return err; > + goto fail; > break; /* we just want the first one */ > } > } > - if (s->nb_streams < 1) /* no luck so far */ > - return -1; > + if (s->nb_streams < 1) { /* no luck so far */ > + err = AVERROR_INVALIDDATA; > + goto fail; > + } > + > /* now read the first chunk, so we can attempt to decode more info */ > err = nsv_read_chunk(s, 1); > +fail: > + if (err < 0) > + nsv_read_close(s); > > av_log(s, AV_LOG_TRACE, "parsed header\n"); > return err; > -- > 2.17.1 > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
On Wed, Mar 18, 2020 at 08:31:30PM +0100, Paul B Mahol wrote:
> lgtm
will apply
thx
[...]
diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c index 7aa1b605b0..b5d9313778 100644 --- a/libavformat/nsvdec.c +++ b/libavformat/nsvdec.c @@ -211,6 +211,7 @@ static const AVCodecTag nsv_codec_audio_tags[] = { //static int nsv_load_index(AVFormatContext *s); static int nsv_read_chunk(AVFormatContext *s, int fill_header); +static int nsv_read_close(AVFormatContext *s); /* try to find something we recognize, and set the state accordingly */ static int nsv_resync(AVFormatContext *s) @@ -492,25 +493,32 @@ static int nsv_read_header(AVFormatContext *s) nsv->ahead[0].data = nsv->ahead[1].data = NULL; for (i = 0; i < NSV_MAX_RESYNC_TRIES; i++) { - if (nsv_resync(s) < 0) - return -1; + err = nsv_resync(s); + if (err < 0) + goto fail; if (nsv->state == NSV_FOUND_NSVF) { err = nsv_parse_NSVf_header(s); if (err < 0) - return err; + goto fail; } /* we need the first NSVs also... */ if (nsv->state == NSV_FOUND_NSVS) { err = nsv_parse_NSVs_header(s); if (err < 0) - return err; + goto fail; break; /* we just want the first one */ } } - if (s->nb_streams < 1) /* no luck so far */ - return -1; + if (s->nb_streams < 1) { /* no luck so far */ + err = AVERROR_INVALIDDATA; + goto fail; + } + /* now read the first chunk, so we can attempt to decode more info */ err = nsv_read_chunk(s, 1); +fail: + if (err < 0) + nsv_read_close(s); av_log(s, AV_LOG_TRACE, "parsed header\n"); return err;
Fixes: memleaks Fixes: 21084/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5655975492321280 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/nsvdec.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)