Message ID | 20190925100120.12305-1-michael@niedermayer.cc |
---|---|
State | Accepted |
Commit | ea770eb55941a6ed7b86828d6ea2f4e718a4b337 |
Headers | show |
On Wed, Sep 25, 2019 at 12:01:17PM +0200, Michael Niedermayer wrote: > Fixes: Assertion failure > Fixes: 17640/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5708767475269632 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/shortendec.c | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) will apply [...]
diff --git a/libavformat/shortendec.c b/libavformat/shortendec.c index a2879dc5a3..f7390b2e62 100644 --- a/libavformat/shortendec.c +++ b/libavformat/shortendec.c @@ -40,12 +40,18 @@ static int shn_probe(const AVProbeData *p) channels = get_ur_golomb_shorten(&gb, 0); blocksize = 256; } else { - int k; + unsigned k; k = get_ur_golomb_shorten(&gb, 2); + if (k > 31) + return 0; internal_ftype = get_ur_golomb_shorten(&gb, k); k = get_ur_golomb_shorten(&gb, 2); + if (k > 31) + return 0; channels = get_ur_golomb_shorten(&gb, k); k = get_ur_golomb_shorten(&gb, 2); + if (k > 31) + return 0; blocksize = get_ur_golomb_shorten(&gb, k); }
Fixes: Assertion failure Fixes: 17640/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5708767475269632 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/shortendec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)