| Message ID | 20210130150021.2584-3-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 869fe41d1088c4badcd98ee1ca2490451a07b173 |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avformat/matroskadec: Check for EOF in resync loop | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
On Sat, Jan 30, 2021 at 04:00:20PM +0100, Michael Niedermayer wrote: > Fixes: Timeout > Fixes: 29226/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-6195092572471296 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/vp3.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c > index 2a1da6b062..57c6eb1ff9 100644 > --- a/libavcodec/vp3.c > +++ b/libavcodec/vp3.c > @@ -2875,6 +2875,9 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb) > int ret; > AVRational fps, aspect; > > + if (get_bits_left(gb) < 206) > + return AVERROR_INVALIDDATA; > + > s->theora_header = 0; > s->theora = get_bits(gb, 24); > av_log(avctx, AV_LOG_DEBUG, "Theora bitstream version %X\n", s->theora); > -- > 2.17.1 ok -- Peter (A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
On Sun, Jan 31, 2021 at 09:53:27AM +1100, Peter Ross wrote: > On Sat, Jan 30, 2021 at 04:00:20PM +0100, Michael Niedermayer wrote: > > Fixes: Timeout > > Fixes: 29226/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-6195092572471296 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/vp3.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c > > index 2a1da6b062..57c6eb1ff9 100644 > > --- a/libavcodec/vp3.c > > +++ b/libavcodec/vp3.c > > @@ -2875,6 +2875,9 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb) > > int ret; > > AVRational fps, aspect; > > > > + if (get_bits_left(gb) < 206) > > + return AVERROR_INVALIDDATA; > > + > > s->theora_header = 0; > > s->theora = get_bits(gb, 24); > > av_log(avctx, AV_LOG_DEBUG, "Theora bitstream version %X\n", s->theora); > > -- > > 2.17.1 > > ok will apply thx [...]
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c index 2a1da6b062..57c6eb1ff9 100644 --- a/libavcodec/vp3.c +++ b/libavcodec/vp3.c @@ -2875,6 +2875,9 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb) int ret; AVRational fps, aspect; + if (get_bits_left(gb) < 206) + return AVERROR_INVALIDDATA; + s->theora_header = 0; s->theora = get_bits(gb, 24); av_log(avctx, AV_LOG_DEBUG, "Theora bitstream version %X\n", s->theora);
Fixes: Timeout Fixes: 29226/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-6195092572471296 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/vp3.c | 3 +++ 1 file changed, 3 insertions(+)