On 3/12/2022 8:52 PM, Michael Niedermayer wrote:
Fixes: Out of array read
Fixes:
45137/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_SUPERFRAME_SPLIT_fuzzer-4984270639202304
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavcodec/vp9_superframe_split_bsf.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavcodec/vp9_superframe_split_bsf.c
b/libavcodec/vp9_superframe_split_bsf.c
index ed0444561a..6af555c078 100644
--- a/libavcodec/vp9_superframe_split_bsf.c
+++ b/libavcodec/vp9_superframe_split_bsf.c
@@ -51,6 +51,11 @@ static int vp9_superframe_split_filter(AVBSFContext *ctx,
AVPacket *out)
return ret;
in = s->buffer_pkt;
+ if (in->size == 0) {
!in->size
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
+
marker = in->data[in->size - 1];
Do we want to abort on in->data && !in->size, or just pass the packet
through?
I'm partial to the latter, so it would mean initializing marker to 0 and
check instead for in->size before setting marker, so the check below
fails and the packet is just passed through.
Not sure what others think about it.
if ((marker & 0xe0) == 0xc0) {
int length_size = 1 + ((marker >> 3) & 0x3);
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
