| Message ID | 20201016173530.9142-4-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 3300f5c133650ba25f94531d40ecc94c79b84457 |
| Headers | show |
| Series | [FFmpeg-devel,1/5] avcodec/mobiclip: Avoid signed integer overflows in idct() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
On Fri, Oct 16, 2020 at 07:35:29PM +0200, Michael Niedermayer wrote: > Fixes: SEGV on unknown address 0x000000000000 > Fixes: 26379/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5709011753893888 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/icodec.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/libavformat/icodec.c b/libavformat/icodec.c > index b47fa98f80..c061f3ec42 100644 > --- a/libavformat/icodec.c > +++ b/libavformat/icodec.c > @@ -156,12 +156,14 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt) > IcoDemuxContext *ico = s->priv_data; > IcoImage *image; > AVIOContext *pb = s->pb; > - AVStream *st = s->streams[0]; > + AVStream *st; > int ret; > > if (ico->current_image >= ico->nb_images) > return AVERROR_EOF; > > + st = s->streams[0]; > + > image = &ico->images[ico->current_image]; > > if ((ret = avio_seek(pb, image->offset, SEEK_SET)) < 0) > -- > 2.17.1 looks good -- Peter (A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
On Sat, Oct 17, 2020 at 07:52:02AM +1100, Peter Ross wrote: > On Fri, Oct 16, 2020 at 07:35:29PM +0200, Michael Niedermayer wrote: > > Fixes: SEGV on unknown address 0x000000000000 > > Fixes: 26379/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5709011753893888 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/icodec.c | 4 +++- > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > diff --git a/libavformat/icodec.c b/libavformat/icodec.c > > index b47fa98f80..c061f3ec42 100644 > > --- a/libavformat/icodec.c > > +++ b/libavformat/icodec.c > > @@ -156,12 +156,14 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt) > > IcoDemuxContext *ico = s->priv_data; > > IcoImage *image; > > AVIOContext *pb = s->pb; > > - AVStream *st = s->streams[0]; > > + AVStream *st; > > int ret; > > > > if (ico->current_image >= ico->nb_images) > > return AVERROR_EOF; > > > > + st = s->streams[0]; > > + > > image = &ico->images[ico->current_image]; > > > > if ((ret = avio_seek(pb, image->offset, SEEK_SET)) < 0) > > -- > > 2.17.1 > > looks good will apply thx [...]
diff --git a/libavformat/icodec.c b/libavformat/icodec.c index b47fa98f80..c061f3ec42 100644 --- a/libavformat/icodec.c +++ b/libavformat/icodec.c @@ -156,12 +156,14 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt) IcoDemuxContext *ico = s->priv_data; IcoImage *image; AVIOContext *pb = s->pb; - AVStream *st = s->streams[0]; + AVStream *st; int ret; if (ico->current_image >= ico->nb_images) return AVERROR_EOF; + st = s->streams[0]; + image = &ico->images[ico->current_image]; if ((ret = avio_seek(pb, image->offset, SEEK_SET)) < 0)
Fixes: SEGV on unknown address 0x000000000000 Fixes: 26379/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5709011753893888 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/icodec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)