diff mbox series

[FFmpeg-devel] avformat/aaxdec: Check avio_seek() in header reading

Message ID 20210619203740.29982-1-michael@niedermayer.cc
State Accepted
Commit 602bbf71f683dc564822c39070c42246d2c2b5e2
Headers show
Series [FFmpeg-devel] avformat/aaxdec: Check avio_seek() in header reading | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Michael Niedermayer June 19, 2021, 8:37 p.m. UTC 
Fixes: Timeout
Fixes: 32450/clusterfuzz-testcase-minimized-ffmpeg_dem_AAX_fuzzer-4875522262827008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/aaxdec.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

Comments

Michael Niedermayer June 20, 2021, 3:43 p.m. UTC | #1 
On Sat, Jun 19, 2021 at 10:37:40PM +0200, Michael Niedermayer wrote:
> Fixes: Timeout
> Fixes: 32450/clusterfuzz-testcase-minimized-ffmpeg_dem_AAX_fuzzer-4875522262827008
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/aaxdec.c | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)

will apply

[...]
diff mbox series

Patch

diff --git a/libavformat/aaxdec.c b/libavformat/aaxdec.c
index 0cbf933dfd..866b3ca1fd 100644
--- a/libavformat/aaxdec.c
+++ b/libavformat/aaxdec.c
@@ -117,6 +117,7 @@  static int aax_read_header(AVFormatContext *s)
     int64_t column_offset = 0;
     int ret, extradata_size;
     char *codec;
+    int64_t ret64;
 
     avio_skip(pb, 4);
     a->table_size      = avio_rb32(pb) + 8LL;
@@ -218,7 +219,10 @@  static int aax_read_header(AVFormatContext *s)
         }
     }
 
-    avio_seek(pb, a->strings_offset, SEEK_SET);
+    ret = ret64 = avio_seek(pb, a->strings_offset, SEEK_SET);
+    if (ret64 < 0)
+        goto fail;
+
     ret = avio_read(pb, a->string_table, a->strings_size);
     if (ret != a->strings_size) {
         if (ret < 0)
@@ -249,7 +253,10 @@  static int aax_read_header(AVFormatContext *s)
                 goto fail;
             }
 
-            avio_seek(pb, data_offset, SEEK_SET);
+            ret = ret64 = avio_seek(pb, data_offset, SEEK_SET);
+            if (ret64 < 0)
+                goto fail;
+
             if (type == COLUMN_TYPE_VLDATA) {
                 int64_t start, size;
 
@@ -281,8 +288,8 @@  static int aax_read_header(AVFormatContext *s)
     codec = a->string_table + a->name_offset;
     if (!strcmp(codec, "AAX")) {
         par->codec_id = AV_CODEC_ID_ADPCM_ADX;
-        avio_seek(pb, a->segments[0].start, SEEK_SET);
-        if (avio_rb16(pb) != 0x8000) {
+        ret64 = avio_seek(pb, a->segments[0].start, SEEK_SET);
+        if (ret64 < 0 || avio_rb16(pb) != 0x8000) {
             ret = AVERROR_INVALIDDATA;
             goto fail;
         }