| Message ID | 20201209165140.4635-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 0677bdb1f522d0d25b47bca3d8e09ece83083678 |
| Headers | show |
| Series | [FFmpeg-devel] avformat/rpl: Check the number of streams | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | warning | Make fate failed |
LGTM On Wed, Dec 9, 2020 at 5:52 PM Michael Niedermayer <michael@niedermayer.cc> wrote: > Fixes: out of memory access > Fixes: > 27787/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4743666463408128.fuzz > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by > <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>: > Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/rpl.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavformat/rpl.c b/libavformat/rpl.c > index c79419d558..b98488c7b1 100644 > --- a/libavformat/rpl.c > +++ b/libavformat/rpl.c > @@ -253,6 +253,9 @@ static int rpl_read_header(AVFormatContext *s) > error |= read_line(pb, line, sizeof(line)); > } > > + if (s->nb_streams == 0) > + return AVERROR_INVALIDDATA; > + > rpl->frames_per_chunk = read_line_and_int(pb, &error); // video > frames per chunk > if (vst && rpl->frames_per_chunk > 1 && vst->codecpar->codec_tag != > 124) > av_log(s, AV_LOG_WARNING, > -- > 2.17.1 > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
On Wed, Dec 09, 2020 at 06:28:40PM +0100, Paul B Mahol wrote:
> LGTM
will apply
thx
[...]
diff --git a/libavformat/rpl.c b/libavformat/rpl.c index c79419d558..b98488c7b1 100644 --- a/libavformat/rpl.c +++ b/libavformat/rpl.c @@ -253,6 +253,9 @@ static int rpl_read_header(AVFormatContext *s) error |= read_line(pb, line, sizeof(line)); } + if (s->nb_streams == 0) + return AVERROR_INVALIDDATA; + rpl->frames_per_chunk = read_line_and_int(pb, &error); // video frames per chunk if (vst && rpl->frames_per_chunk > 1 && vst->codecpar->codec_tag != 124) av_log(s, AV_LOG_WARNING,
Fixes: out of memory access Fixes: 27787/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4743666463408128.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/rpl.c | 3 +++ 1 file changed, 3 insertions(+)