diff mbox series

[FFmpeg-devel,3/5] avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative

Message ID 20201022224112.9071-3-michael@niedermayer.cc
State Accepted
Commit 5eed718087f2ba307a3d1d294016d2ebae9230f3
Headers show
Series [FFmpeg-devel,1/5] avformat/mpegts: Limit iterations of get_packet_size() | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished

Commit Message

Michael Niedermayer Oct. 22, 2020, 10:41 p.m. UTC 
These fields are not signed in the spec (1.0) so they cannot be negative
Changing bytes_per_packet to unsigned would not solve this as it is exported
as block_align which is signed

Fixes: Infinite loop
Fixes: 26492/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5632087614554112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/cafdec.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c
index cd6b550aad..1e9c8c2b0b 100644
--- a/libavformat/cafdec.c
+++ b/libavformat/cafdec.c
@@ -79,6 +79,9 @@  static int read_desc_chunk(AVFormatContext *s)
     st->codecpar->channels    = avio_rb32(pb);
     st->codecpar->bits_per_coded_sample = avio_rb32(pb);
 
+    if (caf->bytes_per_packet < 0 || caf->frames_per_packet < 0)
+        return AVERROR_INVALIDDATA;
+
     /* calculate bit rate for constant size packets */
     if (caf->frames_per_packet > 0 && caf->bytes_per_packet > 0) {
         st->codecpar->bit_rate = (uint64_t)st->codecpar->sample_rate * (uint64_t)caf->bytes_per_packet * 8