On Wed, Feb 24, 2021 at 03:23:40PM +0100, Anton Khirnov wrote: > Quoting Michael Niedermayer (2021-02-15 21:31:23) > > Fixes: OOM > > Fixes: > > 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > > --- > > libavformat/vividas.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/libavformat/vividas.c b/libavformat/vividas.c > > index d745770dc4..b172a48b29 100644 > > --- a/libavformat/vividas.c > > +++ b/libavformat/vividas.c > > @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, > > unsigned *size, > > uint8_t *buf; > > uint8_t ibuf[8], sbuf[8]; > > uint32_t k2; > > - unsigned n; > > + int n; > > > > Why would that be better, when it's assigned a uint32_t?
one (maybe not the only one) issue is
if (avio_read(src, buf+8, n) < n) {
avio_read() returns int and has a int size
so this will not work at all with a unsigned int, not only will it not read
more than INT_MAX it also when it fails with an error fail to treat it as
an error
do you prefer a diferent solution ?
thx
[...]
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
The real ebay dictionary, page 1
"Used only once" - "Some unspecified defect prevented a second use"
"In good condition" - "Can be repaird by experienced expert"
"As is" - "You wouldnt want it even if you were payed for it, if you knew ..."
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
