| Message ID | 20220701192553.12538-1-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,1/2] avutil/channel_layout: av_channel_layout_describe_bprint: Check for buffer end | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On 7/1/2022 4:25 PM, Michael Niedermayer wrote: > Fixes: Timeout printing a billion channels > Fixes: 48099/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6754782204788736 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavutil/channel_layout.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/libavutil/channel_layout.c b/libavutil/channel_layout.c > index 21b70173b7..72969eff14 100644 > --- a/libavutil/channel_layout.c > +++ b/libavutil/channel_layout.c > @@ -757,6 +757,10 @@ int av_channel_layout_describe_bprint(const AVChannelLayout *channel_layout, > if (channel_layout->order == AV_CHANNEL_ORDER_CUSTOM && > channel_layout->u.map[i].name[0]) > av_bprintf(bp, "@%s", channel_layout->u.map[i].name); > + > + if (!av_bprint_is_complete(bp)) > + return AVERROR(EINVAL); Should be ENOMEM. LGTM with that change. > + > } > if (channel_layout->nb_channels) { > av_bprintf(bp, ")");
On Fri, Jul 01, 2022 at 04:30:57PM -0300, James Almer wrote: > On 7/1/2022 4:25 PM, Michael Niedermayer wrote: > > Fixes: Timeout printing a billion channels > > Fixes: 48099/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6754782204788736 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavutil/channel_layout.c | 4 ++++ > > 1 file changed, 4 insertions(+) > > > > diff --git a/libavutil/channel_layout.c b/libavutil/channel_layout.c > > index 21b70173b7..72969eff14 100644 > > --- a/libavutil/channel_layout.c > > +++ b/libavutil/channel_layout.c > > @@ -757,6 +757,10 @@ int av_channel_layout_describe_bprint(const AVChannelLayout *channel_layout, > > if (channel_layout->order == AV_CHANNEL_ORDER_CUSTOM && > > channel_layout->u.map[i].name[0]) > > av_bprintf(bp, "@%s", channel_layout->u.map[i].name); > > + > > + if (!av_bprint_is_complete(bp)) > > + return AVERROR(EINVAL); > > Should be ENOMEM. > > LGTM with that change. will changa and apply thx [...]
diff --git a/libavutil/channel_layout.c b/libavutil/channel_layout.c index 21b70173b7..72969eff14 100644 --- a/libavutil/channel_layout.c +++ b/libavutil/channel_layout.c @@ -757,6 +757,10 @@ int av_channel_layout_describe_bprint(const AVChannelLayout *channel_layout, if (channel_layout->order == AV_CHANNEL_ORDER_CUSTOM && channel_layout->u.map[i].name[0]) av_bprintf(bp, "@%s", channel_layout->u.map[i].name); + + if (!av_bprint_is_complete(bp)) + return AVERROR(EINVAL); + } if (channel_layout->nb_channels) { av_bprintf(bp, ")");
Fixes: Timeout printing a billion channels Fixes: 48099/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6754782204788736 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavutil/channel_layout.c | 4 ++++ 1 file changed, 4 insertions(+)