diff mbox series

[FFmpeg-devel,2/2] avformat/apngdec: Check for incomplete reads in append_extradata()

Message ID 20201031092957.14996-2-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/2] libavformat/aviobuf: Forward error from avio_read in ffio_read_size()
Related show

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Michael Niedermayer Oct. 31, 2020, 9:29 a.m. UTC
Fixes: OOM
Fixes: 26608/clusterfuzz-testcase-minimized-ffmpeg_dem_APNG_fuzzer-4839491644424192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/apngdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Andreas Rheinhardt Oct. 31, 2020, 2:28 p.m. UTC | #1
Michael Niedermayer:
> Fixes: OOM
> Fixes: 26608/clusterfuzz-testcase-minimized-ffmpeg_dem_APNG_fuzzer-4839491644424192
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/apngdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c
> index 0f1d04a365..4e1d21031f 100644
> --- a/libavformat/apngdec.c
> +++ b/libavformat/apngdec.c
> @@ -138,7 +138,7 @@ static int append_extradata(AVCodecParameters *par, AVIOContext *pb, int len)
>      par->extradata = new_extradata;
>      par->extradata_size = new_size;
>  
> -    if ((ret = avio_read(pb, par->extradata + previous_size, len)) < 0)
> +    if ((ret = ffio_read_size(pb, par->extradata + previous_size, len)) < 0)
>          return ret;
>  
>      return previous_size;
> 
There is a second avio_read() call that does not check whether it has
read all it wanted. It can not really lead to OOM (as the extradata size
in this case is 29), but it is not nice to not return an error in this
case. I therefore resurrected my old patchset:
https://ffmpeg.org/pipermail/ffmpeg-devel/2020-October/271779.html

- Andreas
diff mbox series

Patch

diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c
index 0f1d04a365..4e1d21031f 100644
--- a/libavformat/apngdec.c
+++ b/libavformat/apngdec.c
@@ -138,7 +138,7 @@  static int append_extradata(AVCodecParameters *par, AVIOContext *pb, int len)
     par->extradata = new_extradata;
     par->extradata_size = new_size;
 
-    if ((ret = avio_read(pb, par->extradata + previous_size, len)) < 0)
+    if ((ret = ffio_read_size(pb, par->extradata + previous_size, len)) < 0)
         return ret;
 
     return previous_size;