diff mbox series

[FFmpeg-devel,6/6] avformat/mvi: Check audio_data_size to be non negative

Message ID 20210410222446.3012-6-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/6] avformat/cafdec: Check channels
Related show

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Michael Niedermayer April 10, 2021, 10:24 p.m. UTC
Fixes: left shift of negative value -224
Fixes: 32144/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-4971479323246592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mvi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

James Almer April 10, 2021, 10:38 p.m. UTC | #1
On 4/10/2021 7:24 PM, Michael Niedermayer wrote:
> Fixes: left shift of negative value -224
> Fixes: 32144/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-4971479323246592
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavformat/mvi.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/mvi.c b/libavformat/mvi.c
> index cfdbe5d273..10bf24408f 100644
> --- a/libavformat/mvi.c
> +++ b/libavformat/mvi.c
> @@ -73,7 +73,7 @@ static int read_header(AVFormatContext *s)
>       avio_rl16(pb);
>       avio_r8(pb);
>   
> -    if (frames_count == 0 || mvi->audio_data_size == 0)
> +    if (frames_count == 0 || (int)mvi->audio_data_size <= 0)

Make audio_data_size an int in MviDemuxContext instead of casting it 
here. Also, you could remove it from the context altogether, since it's 
only used in read_header().

>           return AVERROR_INVALIDDATA;
>   
>       if (version != 7 || player_version > 213) {
>
Michael Niedermayer April 11, 2021, 5:31 p.m. UTC | #2
On Sat, Apr 10, 2021 at 07:38:36PM -0300, James Almer wrote:
> On 4/10/2021 7:24 PM, Michael Niedermayer wrote:
> > Fixes: left shift of negative value -224
> > Fixes: 32144/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-4971479323246592
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >   libavformat/mvi.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavformat/mvi.c b/libavformat/mvi.c
> > index cfdbe5d273..10bf24408f 100644
> > --- a/libavformat/mvi.c
> > +++ b/libavformat/mvi.c
> > @@ -73,7 +73,7 @@ static int read_header(AVFormatContext *s)
> >       avio_rl16(pb);
> >       avio_r8(pb);
> > -    if (frames_count == 0 || mvi->audio_data_size == 0)
> > +    if (frames_count == 0 || (int)mvi->audio_data_size <= 0)
> 
> Make audio_data_size an int in MviDemuxContext instead of casting it here.
> Also, you could remove it from the context altogether, since it's only used
> in read_header().

will apply with these changes

thx


[...]
diff mbox series

Patch

diff --git a/libavformat/mvi.c b/libavformat/mvi.c
index cfdbe5d273..10bf24408f 100644
--- a/libavformat/mvi.c
+++ b/libavformat/mvi.c
@@ -73,7 +73,7 @@  static int read_header(AVFormatContext *s)
     avio_rl16(pb);
     avio_r8(pb);
 
-    if (frames_count == 0 || mvi->audio_data_size == 0)
+    if (frames_count == 0 || (int)mvi->audio_data_size <= 0)
         return AVERROR_INVALIDDATA;
 
     if (version != 7 || player_version > 213) {