[FFmpeg-devel] [PATCH 1/4] avformat/shortendec: Check k in probe
Michael Niedermayer
michael at niedermayer.cc
Wed Sep 25 13:01:17 EEST 2019
Fixes: Assertion failure
Fixes: 17640/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5708767475269632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
libavformat/shortendec.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/libavformat/shortendec.c b/libavformat/shortendec.c
index a2879dc5a3..f7390b2e62 100644
--- a/libavformat/shortendec.c
+++ b/libavformat/shortendec.c
@@ -40,12 +40,18 @@ static int shn_probe(const AVProbeData *p)
channels = get_ur_golomb_shorten(&gb, 0);
blocksize = 256;
} else {
- int k;
+ unsigned k;
k = get_ur_golomb_shorten(&gb, 2);
+ if (k > 31)
+ return 0;
internal_ftype = get_ur_golomb_shorten(&gb, k);
k = get_ur_golomb_shorten(&gb, 2);
+ if (k > 31)
+ return 0;
channels = get_ur_golomb_shorten(&gb, k);
k = get_ur_golomb_shorten(&gb, 2);
+ if (k > 31)
+ return 0;
blocksize = get_ur_golomb_shorten(&gb, k);
}
--
2.23.0
More information about the ffmpeg-devel
mailing list