On 7/13/2025 3:10 AM, Michael Niedermayer wrote:
Fixes: Infinite loop
Fixes:
427538726/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-6582567304495104
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavformat/flvdec.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
index ac681954cb7..a4fa0157512 100644
--- a/libavformat/flvdec.c
+++ b/libavformat/flvdec.c
@@ -1715,6 +1715,9 @@ retry_duration:
av_log(s, AV_LOG_DEBUG, "Set channel data from MultiChannel info.\n");
+ if (avio_feof(s->pb))
+ return AVERROR_EOF;
+
goto next_track;
}
} else if (stream_type == FLV_STREAM_TYPE_VIDEO) {
I don't think just returning from here is correct.
The goto next_track right after it already checks for EOF.
I do not see how between here and the eof check there there'd be any way
to infinite loop.
It returns FFERROR_REDO there, which is important to drain queued up
packages.
The next time a call hits flv_read_packet will then immediately return
AVERROR_EOF, since it's one of the first things the function checks.
So just throwing in a random AVERROR_EOF there seems incorrect to me,
and is only hiding an actual issue elsewhere, if there is one.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
