Message ID | 20201123004304.23464-2-michael@niedermayer.cc |
---|---|
State | Accepted |
Commit | b29d351f972f801d0374ca8565cee398b8f69160 |
Headers | show |
Series | [FFmpeg-devel,1/6] avcodec/vp9dsp_template: Fix integer overflows in itxfm_wrapper | expand |
Context | Check | Description |
---|---|---|
andriy/x86_make | success | Make finished |
andriy/x86_make_fate | success | Make fate finished |
On Mon, Nov 23, 2020 at 01:43:00AM +0100, Michael Niedermayer wrote: > Fixes: out of array access > Fixes: 27424/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5682070692823040 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/vividas.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) will apply [...]
diff --git a/libavformat/vividas.c b/libavformat/vividas.c index 46c66bf9a0..4adc125439 100644 --- a/libavformat/vividas.c +++ b/libavformat/vividas.c @@ -389,8 +389,8 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t * ffio_read_varlen(pb); // len_3 num_data = avio_r8(pb); for (j = 0; j < num_data; j++) { - uint64_t len = ffio_read_varlen(pb); - if (len > INT_MAX/2 - xd_size) { + int64_t len = ffio_read_varlen(pb); + if (len < 0 || len > INT_MAX/2 - xd_size) { return AVERROR_INVALIDDATA; } data_len[j] = len;
Fixes: out of array access Fixes: 27424/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5682070692823040 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/vividas.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)