ffmpeg | branch: master | Michael Niedermayer <mich...@niedermayer.cc> | Sun Jun 11 22:08:04 2017 +0200| [07339a45a04e5fa0848937090511d69a39a04740] | committer: Michael Niedermayer
avcodec/avpacket: Limit iterations in ff_packet_split_and_drop_side_data() This avoids scaning beyond what a valid packet can contain Fixes: Timeout Fixes: 541/clusterfuzz-testcase-610189291657625 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=07339a45a04e5fa0848937090511d69a39a04740 --- libavcodec/avpacket.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c index a04cdaf530..5ce3228166 100644 --- a/libavcodec/avpacket.c +++ b/libavcodec/avpacket.c @@ -495,6 +495,8 @@ int ff_packet_split_and_drop_side_data(AVPacket *pkt){ if (p - pkt->data < size + 5) return 0; p-= size+5; + if (i > AV_PKT_DATA_NB) + return 0; } pkt->size = p - pkt->data - size; av_assert0(pkt->size >= 0); _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
