generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/mpc8: fix hang with fuzzed file

Browse Source 
This can lead to an endless loop by seeking back a few bytes after each
attempted chunk read. Assuming negative sizes are always invalid, this
is easy to fix. Other code in this demuxer treats negative sizes as
invalid as well.

Fixes ticket #4262.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56cc024220)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
wm4
2015-02-03 19:04:12 +01:00
committed by Michael Niedermayer
parent 6e7f183ae6
commit 28f303542e
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/mpc8.c
View File

@@ -216,6 +216,10 @@ static int mpc8_read_header(AVFormatContext *s)
while(!url_feof(pb)){ while(!url_feof(pb)){
pos = avio_tell(pb); pos = avio_tell(pb);
mpc8_get_chunk_header(pb, &tag, &size); mpc8_get_chunk_header(pb, &tag, &size);
if (size < 0) {
av_log(s, AV_LOG_ERROR, "Invalid chunk length\n");
return AVERROR_INVALIDDATA;
}
if(tag == TAG_STREAMHDR) if(tag == TAG_STREAMHDR)
break; break;
mpc8_handle_chunk(s, tag, pos, size); mpc8_handle_chunk(s, tag, pos, size);