highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/avpacket: Limit iterations in ff_packet_split_and_drop_side_data()

Browse Source 
This avoids scaning beyond what a valid packet can contain
Fixes: Timeout
Fixes: 541/clusterfuzz-testcase-610189291657625

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2017-06-11 22:08:04 +02:00
parent d24043e1a2
commit 07339a45a0
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/avpacket.c
View File

@@ -495,6 +495,8 @@ int ff_packet_split_and_drop_side_data(AVPacket *pkt){
if (p - pkt->data < size + 5) if (p - pkt->data < size + 5)
return 0; return 0;
p-= size+5; p-= size+5;
if (i > AV_PKT_DATA_NB)
return 0;
} }
pkt->size = p - pkt->data - size; pkt->size = p - pkt->data - size;
av_assert0(pkt->size >= 0); av_assert0(pkt->size >= 0);