Michael Niedermayer:
> Fixes: Timeout (too long -> instantly)
> Fixes: 
> 29136/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4586141227548672
> 
> Found-by: continuous fuzzing process 
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
> ---
>  libavformat/matroskadec.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
> index 374831baa3..1f28108887 100644
> --- a/libavformat/matroskadec.c
> +++ b/libavformat/matroskadec.c
> @@ -2895,6 +2895,8 @@ static int matroska_read_header(AVFormatContext *s)
>              goto fail;
>          pos = avio_tell(matroska->ctx->pb);
>          res = ebml_parse(matroska, matroska_segment, matroska);
> +        if (res == AVERROR(EIO)) // EOF is translated to EIO, this exists 
> the loop on EOF
> +            goto fail;
>      }
>      /* Set data_offset as it might be needed later by seek_frame_generic. */
>      if (matroska->current_id == MATROSKA_ID_CLUSTER)
> 

I see two types of files for which this check can be problematic: Those
with an unknown-length segment and truncated files: In both cases a
child element may extend beyond the actually existing data without this
being caught by the check for whether the element extends beyond its
parent (i.e. beyond the end of the segment). But I don't really see a
better way, so go ahead.

- Andreas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".

Reply via email to