Fixes: Timeout (Infinite->Finite) Fixes: 15706/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5114674904825856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/tiff.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index c520d7df83..8c9e7b0881 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -1407,7 +1407,7 @@ static int decode_frame(AVCodecContext *avctx, GetByteContext stripsizes; GetByteContext stripdata; int retry_for_subifd, retry_for_page; - + int retry_count = 1; bytestream2_init(&s->gb, avpkt->data, avpkt->size); // parse image header @@ -1467,6 +1467,10 @@ again: av_log(avctx, AV_LOG_ERROR, "IFD offset is greater than image size\n"); return AVERROR_INVALIDDATA; } + if (!retry_count--) { + av_log(avctx, AV_LOG_ERROR, "too many retries\n"); + return AVERROR_INVALIDDATA; + } s->sub_ifd = 0; goto again; } -- 2.22.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
