eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-19 13:30:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

avformat/mlvdec: fix size checks

Browse Source 
Fixes: heap-buffer-overflow
Fixes: 391962476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-5746746587676672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 251d43aef0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-02-07 02:33:21 +01:00
parent 5c072bd7e1
commit 7dc39ecb8f
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
libavformat/mlvdec.c
View File

@@ -420,19 +420,25 @@ static int read_packet(AVFormatContext *avctx, AVPacket *pkt)
if (size < 16) if (size < 16)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
avio_skip(pb, 12); //timestamp, frameNumber avio_skip(pb, 12); //timestamp, frameNumber
if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) size -= 12;
if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
if (size < 8)
return AVERROR_INVALIDDATA;
avio_skip(pb, 8); // cropPosX, cropPosY, panPosX, panPosY avio_skip(pb, 8); // cropPosX, cropPosY, panPosX, panPosY
size -= 8;
}
space = avio_rl32(pb); space = avio_rl32(pb);
if (size < space + 4LL)
return AVERROR_INVALIDDATA;
avio_skip(pb, space); avio_skip(pb, space);
size -= space;
if ((mlv->class[st->id] & (MLV_CLASS_FLAG_DELTA|MLV_CLASS_FLAG_LZMA))) { if ((mlv->class[st->id] & (MLV_CLASS_FLAG_DELTA|MLV_CLASS_FLAG_LZMA))) {
ret = AVERROR_PATCHWELCOME; ret = AVERROR_PATCHWELCOME;
} else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) { } else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
ret = av_get_packet(pb, pkt, (st->codecpar->width * st->codecpar->height * st->codecpar->bits_per_coded_sample + 7) >> 3); ret = av_get_packet(pb, pkt, (st->codecpar->width * st->codecpar->height * st->codecpar->bits_per_coded_sample + 7) >> 3);
} else { // AVMEDIA_TYPE_AUDIO } else { // AVMEDIA_TYPE_AUDIO
if (space > UINT_MAX - 24 || size < (24 + space)) ret = av_get_packet(pb, pkt, size - 4);
return AVERROR_INVALIDDATA;
ret = av_get_packet(pb, pkt, size - (24 + space));
} }
if (ret < 0) if (ret < 0)