diff mbox series

[FFmpeg-devel,1/2] avformat/4xm: Check that a video stream was created before returning packets for it

Message ID 20200614180647.7024-1-michael@niedermayer.cc
State Accepted
Commit c517c3f4741b6897ea952d1fba199c93c5217cfe
Headers show
Series [FFmpeg-devel,1/2] avformat/4xm: Check that a video stream was created before returning packets for it
Related show

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

Michael Niedermayer June 14, 2020, 6:06 p.m. UTC
Fixes: assertion failure
Fixes: 23434/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5227750851084288.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/4xm.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Michael Niedermayer June 14, 2020, 7:22 p.m. UTC | #1
On Sun, Jun 14, 2020 at 08:06:46PM +0200, Michael Niedermayer wrote:
> Fixes: assertion failure
> Fixes: 23434/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5227750851084288.fuzz
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/4xm.c | 3 +++
>  1 file changed, 3 insertions(+)

will apply

[...]
diff mbox series

Patch

diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index 5f0504b13e..6a227a0b0d 100644
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -218,6 +218,7 @@  static int fourxm_read_header(AVFormatContext *s)
     fourxm->track_count = 0;
     fourxm->tracks      = NULL;
     fourxm->fps         = (AVRational){1,1};
+    fourxm->video_stream_index = -1;
 
     /* skip the first 3 32-bit numbers */
     avio_skip(pb, 12);
@@ -326,6 +327,8 @@  static int fourxm_read_packet(AVFormatContext *s,
              * and size */
             if (size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE - 8)
                 return AVERROR_INVALIDDATA;
+            if (fourxm->video_stream_index < 0)
+                return AVERROR_INVALIDDATA;
             if ((ret = av_new_packet(pkt, size + 8)) < 0)
                 return ret;
             pkt->stream_index = fourxm->video_stream_index;