[FFmpeg-devel] [PATCH 1/3] avformat/lafdec: Check for EOF in header reading

From: Michael Niedermayer <michael@niedermayer.cc>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Subject: [FFmpeg-devel] [PATCH 1/3] avformat/lafdec: Check for EOF in header reading
Date: Sun, 13 Nov 2022 00:43:59 +0100
Message-ID: <20221112234401.24158-1-michael@niedermayer.cc> (raw)

Fixes: OOM testcase
Fixes: 51527/clusterfuzz-testcase-minimized-ffmpeg_dem_LAF_fuzzer-5453663505612800

OOM can still happen after this as an arbitrary sized block is allocated and read
this would require a redesign or some limit on the sample rate.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/lafdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/lafdec.c b/libavformat/lafdec.c
index 12b0d8540b..d02b479c4d 100644
--- a/libavformat/lafdec.c
+++ b/libavformat/lafdec.c
@@ -111,6 +111,9 @@ static int laf_read_header(AVFormatContext *ctx)
     sample_rate = avio_rl32(pb);
     duration = avio_rl64(pb) / st_count;
 
+    if (avio_feof(pb))
+        return AVERROR_INVALIDDATA;
+
     switch (quality) {
     case 0:
         codec_id = AV_CODEC_ID_PCM_U8;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
