diff mbox

[FFmpeg-devel] avcodec/avpacket: Check metadata key in av_packet_unpack_dictionary()

Message ID 20170227031209.7611-1-michael@niedermayer.cc
State Accepted
Commit 2c00b373024054e0779ef67fc54b763d624db3e8
Headers show

Commit Message

Michael Niedermayer Feb. 27, 2017, 3:12 a.m. UTC 
Fixes timeout
Fixes: 501/clusterfuzz-testcase-5672752870588416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/avpacket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Michael Niedermayer March 1, 2017, 12:15 p.m. UTC | #1 
On Mon, Feb 27, 2017 at 04:12:09AM +0100, Michael Niedermayer wrote:
> Fixes timeout
> Fixes: 501/clusterfuzz-testcase-5672752870588416
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/avpacket.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

applied

[...]
diff mbox

Patch

diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c
index 8e028a2a6c..60269aa63d 100644
--- a/libavcodec/avpacket.c
+++ b/libavcodec/avpacket.c
@@ -508,7 +508,7 @@  int av_packet_unpack_dictionary(const uint8_t *data, int size, AVDictionary **di
         const uint8_t *key = data;
         const uint8_t *val = data + strlen(key) + 1;
 
-        if (val >= end)
+        if (val >= end || !*key)
             return AVERROR_INVALIDDATA;
 
         ret = av_dict_set(dict, key, val, 0);