[FFmpeg-devel] [PATCH] avformat/mxfdec: Check index_duration

[Michael Niedermayer]

Fixes: OOM
Fixes: 50551/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6607795234930688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavformat/mxfdec.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 0553728253..64ac6a44b8 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1943,6 +1943,10 @@ static int mxf_compute_ptses_fake_index(MXFContext *mxf, MXFIndexTable *index_ta
         }
 
         index_table->nb_ptses += s->index_duration;
+        // If index_duration is substantially larger than nb_index_entries then this algorithm which
+        // allocates index_duration elements is a bad idea. All files i tried have it equal
+        if (s->index_duration > 10LL * s->nb_index_entries)
+            return AVERROR_PATCHWELCOME;
     }
 
     /* paranoid check */
-- 
2.17.1