| Message ID | 20201021223733.2563-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | c0d7fd269beed030fc767fee28d9dbe111bc4427 |
| Headers | show |
| Series | [FFmpeg-devel,1/9] avformat/segafilm: Check that there is a stream | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
Michael Niedermayer: > Fixes: assertion failure > Fixes: 26472/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5759751591559168 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/segafilm.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavformat/segafilm.c b/libavformat/segafilm.c > index 4d14b81d16..17592c905e 100644 > --- a/libavformat/segafilm.c > +++ b/libavformat/segafilm.c > @@ -144,6 +144,9 @@ static int film_read_header(AVFormatContext *s) > film->video_type = AV_CODEC_ID_NONE; > } > > + if (!film->video_type && !film->audio_type) > + return AVERROR_INVALIDDATA; > + > /* initialize the decoder streams */ > if (film->video_type) { > st = avformat_new_stream(s, NULL); > This basically presumes that the value of AV_CODEC_ID_NONE is zero. This assumption should be avoided (as can be done easily here). LGTM apart from that. - Andreas
On Thu, Oct 22, 2020 at 07:20:49AM +0200, Andreas Rheinhardt wrote: > Michael Niedermayer: > > Fixes: assertion failure > > Fixes: 26472/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5759751591559168 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/segafilm.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/libavformat/segafilm.c b/libavformat/segafilm.c > > index 4d14b81d16..17592c905e 100644 > > --- a/libavformat/segafilm.c > > +++ b/libavformat/segafilm.c > > @@ -144,6 +144,9 @@ static int film_read_header(AVFormatContext *s) > > film->video_type = AV_CODEC_ID_NONE; > > } > > > > + if (!film->video_type && !film->audio_type) > > + return AVERROR_INVALIDDATA; > > + > > /* initialize the decoder streams */ > > if (film->video_type) { > > st = avformat_new_stream(s, NULL); > > > This basically presumes that the value of AV_CODEC_ID_NONE is zero. This > assumption should be avoided (as can be done easily here). LGTM apart > from that. This decoder assumes AV_CODEC_ID_NONE is zero in 5 other places already. But ill fix all cases in this decoder. But even with that changing AV_CODEC_ID_NONE to 1 causes 2970 fate tests to fail thx [...]
On Thu, Oct 22, 2020 at 12:37:25AM +0200, Michael Niedermayer wrote: > Fixes: assertion failure > Fixes: 26472/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5759751591559168 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/segafilm.c | 3 +++ > 1 file changed, 3 insertions(+) will apply not yet applied parts of this set [...]
diff --git a/libavformat/segafilm.c b/libavformat/segafilm.c index 4d14b81d16..17592c905e 100644 --- a/libavformat/segafilm.c +++ b/libavformat/segafilm.c @@ -144,6 +144,9 @@ static int film_read_header(AVFormatContext *s) film->video_type = AV_CODEC_ID_NONE; } + if (!film->video_type && !film->audio_type) + return AVERROR_INVALIDDATA; + /* initialize the decoder streams */ if (film->video_type) { st = avformat_new_stream(s, NULL);
Fixes: assertion failure Fixes: 26472/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5759751591559168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/segafilm.c | 3 +++ 1 file changed, 3 insertions(+)