highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/vividas: better check of current_sb_entry

Browse Source 
This is the simplest fix for the problem, it is possible to instead check
this when the variables are set and propagate errors and then fail earlier

Fixes: out of array access
Fixes: 26490/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5723367078100992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b848baef0dc42d97a5c1ab975cc8994a265b88ae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-10-21 23:05:41 +02:00
parent cd733f1c88
commit bd79a4e0ec
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/vividas.c
View File

@ -671,6 +671,10 @@ static int viv_read_packet(AVFormatContext *s,
if (!pb)
return AVERROR(EIO);
off = avio_tell(pb);
if (viv->current_sb_entry >= viv->n_sb_entries)
return AVERROR_INVALIDDATA;
off += viv->sb_entries[viv->current_sb_entry].size;
if (viv->sb_entries[viv->current_sb_entry].flag == 0) {