Re: [FFmpeg-devel] [PATCH 5/5] avformat/mov: Check if heif item name is already allocated

From: James Almer <jamrial@gmail.com>
To: ffmpeg-devel@ffmpeg.org
Subject: Re: [FFmpeg-devel] [PATCH 5/5] avformat/mov: Check if heif item name is already allocated
Date: Fri, 26 Apr 2024 20:57:02 -0300
Message-ID: <a1f6af43-fc4b-4bf0-a118-2d6c9e733ae8@gmail.com> (raw)
In-Reply-To: <20240426235211.3718252-5-michael@niedermayer.cc>

On 4/26/2024 8:52 PM, Michael Niedermayer wrote:
> Fixes: memleak
> Fixes: 68212/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4963488540721152
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavformat/mov.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/libavformat/mov.c b/libavformat/mov.c
> index 97a24e6737e..5b8278f736e 100644
> --- a/libavformat/mov.c
> +++ b/libavformat/mov.c
> @@ -8136,6 +8136,9 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx)
>       avio_rb24(pb);  // flags.
>       size -= 4;
>   
> +    if (c->heif_item[idx].name)
> +        return AVERROR_INVALIDDATA;

I prefer to free the old one before the av_bprint_finalize() call 
instead of aborting.

> +
>       if (version < 2) {
>           avpriv_report_missing_feature(c->fc, "infe version < 2");
>           return 1;
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".