From c48110a4a4b3ba87cb3ffe66753bff13c618a04d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 28 Nov 2020 23:43:23 +0100 Subject: [PATCH] avformat/id3v2: Check against max compression ratio before allocation Fixes: Timeout (>10sec -> 12ms) Fixes: 27612/clusterfuzz-testcase-minimized-ffmpeg_dem_PCM_S24BE_fuzzer-6605893000757248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/id3v2.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/id3v2.c b/libavformat/id3v2.c index 336a3964de..97f6cc8a68 100644 --- a/libavformat/id3v2.c +++ b/libavformat/id3v2.c @@ -995,6 +995,8 @@ static void id3v2_parse(AVIOContext *pb, AVDictionary **metadata, if (tlen <= 0) goto seek; + if (dlen / 32768 > tlen) + goto seek; av_fast_malloc(&uncompressed_buffer, &uncompressed_buffer_size, dlen); if (!uncompressed_buffer) {