| Message ID | 20201224232419.10369-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 78d6d8ddb571ecca54616517defbf894a45ea9c3 |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avformat/mpc8: Check size before implicitly converting to int | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
On Fri, Dec 25, 2020 at 12:24:16AM +0100, Michael Niedermayer wrote: > Fixes: Timeout > Fixes: 28551/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6229183210586112 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/mpc8.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) will apply patchset [...]
diff --git a/libavformat/mpc8.c b/libavformat/mpc8.c index 447a8d4fdf..ff7da2ef55 100644 --- a/libavformat/mpc8.c +++ b/libavformat/mpc8.c @@ -292,7 +292,7 @@ static int mpc8_read_packet(AVFormatContext *s, AVPacket *pkt) return AVERROR_EOF; mpc8_get_chunk_header(s->pb, &tag, &size); - if (size < 0) + if (size < 0 || size > INT_MAX) return -1; if(tag == TAG_AUDIOPACKET){ if ((ret = av_get_packet(s->pb, pkt, size)) < 0)
Fixes: Timeout Fixes: 28551/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6229183210586112 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/mpc8.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)