Message ID | 20201109230456.11188-4-michael@niedermayer.cc |
---|---|
State | Accepted |
Commit | 7540d60bf687ae1f18927c5e6c3dbd317df9f35e |
Headers | show |
Series | [FFmpeg-devel,1/7] avformat/sbgdec: Check that end is not before start | expand |
Context | Check | Description |
---|---|---|
andriy/x86_make | success | Make finished |
andriy/x86_make_fate | success | Make fate finished |
On Tue, Nov 10, 2020 at 12:04:53AM +0100, Michael Niedermayer wrote: > Fixes: Infinite loop > Fixes: 26922/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-5794549613723648 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/dhav.c | 2 ++ > 1 file changed, 2 insertions(+) will apply [...]
diff --git a/libavformat/dhav.c b/libavformat/dhav.c index 53deaff77e..6989b9bc01 100644 --- a/libavformat/dhav.c +++ b/libavformat/dhav.c @@ -290,6 +290,8 @@ static int dhav_read_header(AVFormatContext *s) int seek_back; seek_back = avio_rl32(s->pb) + 8; + if (seek_back < 9) + break; dhav->last_good_pos = avio_tell(s->pb); avio_seek(s->pb, -seek_back, SEEK_CUR); }
Fixes: Infinite loop Fixes: 26922/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-5794549613723648 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/dhav.c | 2 ++ 1 file changed, 2 insertions(+)