| Message ID | 20230921180912.10733-6-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,1/6] avcodec/osq: Check that pkt_offset does not exceed pkt size | expand |
| Context | Check | Description |
|---|---|---|
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
Quoting Michael Niedermayer (2023-09-21 20:09:12) > Fixes: leak > Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6674082962997248 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/mov.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavformat/mov.c b/libavformat/mov.c > index 93c1f9e929a..52939a373ec 100644 > --- a/libavformat/mov.c > +++ b/libavformat/mov.c > @@ -7767,7 +7767,7 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) > return 0; > } > > - if (c->fc->nb_streams) { > + if (c->fc->nb_streams || c->avif_info) { I remember seeing this patch before and asking whether the first condition is not redundant now.
On Thu, Sep 28, 2023 at 12:37:57PM +0200, Anton Khirnov wrote: > Quoting Michael Niedermayer (2023-09-21 20:09:12) > > Fixes: leak > > Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6674082962997248 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/mov.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/libavformat/mov.c b/libavformat/mov.c > > index 93c1f9e929a..52939a373ec 100644 > > --- a/libavformat/mov.c > > +++ b/libavformat/mov.c > > @@ -7767,7 +7767,7 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) > > return 0; > > } > > > > - if (c->fc->nb_streams) { > > + if (c->fc->nb_streams || c->avif_info) { > > I remember seeing this patch before and asking whether the first > condition is not redundant now. right, the author of the underlaying code also suggested its redundant, so as suggested there ill apply it with just the 2nd check thx [...]
diff --git a/libavformat/mov.c b/libavformat/mov.c index 93c1f9e929a..52939a373ec 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -7767,7 +7767,7 @@ static int mov_read_iloc(MOVContext *c, AVIOContext *pb, MOVAtom atom) return 0; } - if (c->fc->nb_streams) { + if (c->fc->nb_streams || c->avif_info) { av_log(c->fc, AV_LOG_INFO, "Duplicate iloc box found\n"); return 0; }
Fixes: leak Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6674082962997248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)