| Message ID | 20221112234401.24158-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | b92260f70a4ac194d1cc09c40b92766d38c7c783 |
| Headers | show |
| Series | [FFmpeg-devel,1/3] avformat/lafdec: Check for EOF in header reading | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Sun, Nov 13, 2022 at 12:43:59AM +0100, Michael Niedermayer wrote: > Fixes: OOM testcase > Fixes: 51527/clusterfuzz-testcase-minimized-ffmpeg_dem_LAF_fuzzer-5453663505612800 > > OOM can still happen after this as an arbitrary sized block is allocated and read > this would require a redesign or some limit on the sample rate. > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/lafdec.c | 3 +++ > 1 file changed, 3 insertions(+) will apply [...]
diff --git a/libavformat/lafdec.c b/libavformat/lafdec.c index 12b0d8540b..d02b479c4d 100644 --- a/libavformat/lafdec.c +++ b/libavformat/lafdec.c @@ -111,6 +111,9 @@ static int laf_read_header(AVFormatContext *ctx) sample_rate = avio_rl32(pb); duration = avio_rl64(pb) / st_count; + if (avio_feof(pb)) + return AVERROR_INVALIDDATA; + switch (quality) { case 0: codec_id = AV_CODEC_ID_PCM_U8;
Fixes: OOM testcase Fixes: 51527/clusterfuzz-testcase-minimized-ffmpeg_dem_LAF_fuzzer-5453663505612800 OOM can still happen after this as an arbitrary sized block is allocated and read this would require a redesign or some limit on the sample rate. Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/lafdec.c | 3 +++ 1 file changed, 3 insertions(+)