[FFmpeg-cvslog] avformat/vqf: Check header_size
Michael Niedermayer
git at videolan.org
Mon Jul 8 14:08:54 EEST 2019
ffmpeg | branch: release/4.1 | Michael Niedermayer <michael at niedermayer.cc> | Tue Jun 18 23:17:23 2019 +0200| [5b8bce805c687e3558f0c77deea49aa97190e0ed] | committer: Michael Niedermayer
avformat/vqf: Check header_size
Fixes: 15271/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5735262606327808
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 7c30ff38880570377168096417f714b21102b343)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5b8bce805c687e3558f0c77deea49aa97190e0ed
---
libavformat/vqf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavformat/vqf.c b/libavformat/vqf.c
index d00fa5e08c..ff38a3d1ca 100644
--- a/libavformat/vqf.c
+++ b/libavformat/vqf.c
@@ -107,6 +107,9 @@ static int vqf_read_header(AVFormatContext *s)
header_size = avio_rb32(s->pb);
+ if (header_size < 0)
+ return AVERROR_INVALIDDATA;
+
st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
st->codecpar->codec_id = AV_CODEC_ID_TWINVQ;
st->start_time = 0;
@@ -120,7 +123,7 @@ static int vqf_read_header(AVFormatContext *s)
len = avio_rb32(s->pb);
- if ((unsigned) len > INT_MAX/2) {
+ if ((unsigned) len > INT_MAX/2 || header_size < 8) {
av_log(s, AV_LOG_ERROR, "Malformed header\n");
return -1;
}
More information about the ffmpeg-cvslog
mailing list