| Message ID | 20210801193031.4094-4-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 89505d38de989bddd579ce3b841f1c011f1d7bf2 |
| Headers | show |
| Series | [FFmpeg-devel,1/4] tools/target_dec_fuzzer: check max samples in flush loop | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
On Sun, Aug 01, 2021 at 09:30:31PM +0200, Michael Niedermayer wrote: > Fixes: Infinite loop > Fixes: 36311/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-4889181296918528 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/wtvdec.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c > index a549681322..191da2718b 100644 > --- a/libavformat/wtvdec.c > +++ b/libavformat/wtvdec.c > @@ -652,6 +652,8 @@ static AVStream * parse_media_type(AVFormatContext *s, AVStream *st, int sid, > avio_skip(pb, size - 32); > ff_get_guid(pb, &actual_subtype); > ff_get_guid(pb, &actual_formattype); > + if (avio_feof(pb)) > + return NULL; > avio_seek(pb, -size, SEEK_CUR); > > st = parse_media_type(s, st, sid, mediatype, actual_subtype, actual_formattype, size - 32); ok -- Peter (A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
On Mon, Aug 02, 2021 at 08:21:29AM +1000, Peter Ross wrote: > On Sun, Aug 01, 2021 at 09:30:31PM +0200, Michael Niedermayer wrote: > > Fixes: Infinite loop > > Fixes: 36311/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-4889181296918528 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/wtvdec.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c > > index a549681322..191da2718b 100644 > > --- a/libavformat/wtvdec.c > > +++ b/libavformat/wtvdec.c > > @@ -652,6 +652,8 @@ static AVStream * parse_media_type(AVFormatContext *s, AVStream *st, int sid, > > avio_skip(pb, size - 32); > > ff_get_guid(pb, &actual_subtype); > > ff_get_guid(pb, &actual_formattype); > > + if (avio_feof(pb)) > > + return NULL; > > avio_seek(pb, -size, SEEK_CUR); > > > > st = parse_media_type(s, st, sid, mediatype, actual_subtype, actual_formattype, size - 32); > > ok will apply thx [...]
diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c index a549681322..191da2718b 100644 --- a/libavformat/wtvdec.c +++ b/libavformat/wtvdec.c @@ -652,6 +652,8 @@ static AVStream * parse_media_type(AVFormatContext *s, AVStream *st, int sid, avio_skip(pb, size - 32); ff_get_guid(pb, &actual_subtype); ff_get_guid(pb, &actual_formattype); + if (avio_feof(pb)) + return NULL; avio_seek(pb, -size, SEEK_CUR); st = parse_media_type(s, st, sid, mediatype, actual_subtype, actual_formattype, size - 32);
Fixes: Infinite loop Fixes: 36311/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-4889181296918528 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/wtvdec.c | 2 ++ 1 file changed, 2 insertions(+)