diff mbox series

[FFmpeg-devel,6/7] avformat/avidec: dv does not support palettes

Message ID 20201109230456.11188-6-michael@niedermayer.cc
State Accepted
Commit 1b373b41d940e3058cdfb3d17703e23ed665353c
Headers show
Series [FFmpeg-devel,1/7] avformat/sbgdec: Check that end is not before start | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished

Commit Message

Michael Niedermayer Nov. 9, 2020, 11:04 p.m. UTC 
Fixes: memleak
Fixes: 26937/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5763003338981376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/avidec.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

Michael Niedermayer Jan. 21, 2021, 6:52 p.m. UTC | #1 
On Tue, Nov 10, 2020 at 12:04:55AM +0100, Michael Niedermayer wrote:
> Fixes: memleak
> Fixes: 26937/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5763003338981376
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/avidec.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)

will apply

[...]
diff mbox series

Patch

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index 7e527e15ee..0044499c6d 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -1446,6 +1446,7 @@  resync:
     if (avi->stream_index >= 0) {
         AVStream *st   = s->streams[avi->stream_index];
         AVIStream *ast = st->priv_data;
+        int dv_demux = CONFIG_DV_DEMUXER && avi->dv_demux;
         int size, err;
 
         if (get_subtitle_pkt(s, st, pkt))
@@ -1468,7 +1469,7 @@  resync:
             return err;
         size = err;
 
-        if (ast->has_pal && pkt->size < (unsigned)INT_MAX / 2) {
+        if (ast->has_pal && pkt->size < (unsigned)INT_MAX / 2 && !dv_demux) {
             uint8_t *pal;
             pal = av_packet_new_side_data(pkt,
                                           AV_PKT_DATA_PALETTE,
@@ -1482,7 +1483,7 @@  resync:
             }
         }
 
-        if (CONFIG_DV_DEMUXER && avi->dv_demux) {
+        if (dv_demux) {
             AVBufferRef *avbuf = pkt->buf;
             size = avpriv_dv_produce_packet(avi->dv_demux, pkt,
                                             pkt->data, pkt->size, pkt->pos);