Michael Niedermayer: > On Wed, Feb 24, 2021 at 03:23:40PM +0100, Anton Khirnov wrote: >> Quoting Michael Niedermayer (2021-02-15 21:31:23) >>> Fixes: OOM >>> Fixes: >>> 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688 >>> >>> Found-by: continuous fuzzing process >>> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg >>> Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> >>> --- >>> libavformat/vividas.c | 2 +- >>> 1 file changed, 1 insertion(+), 1 deletion(-) >>> >>> diff --git a/libavformat/vividas.c b/libavformat/vividas.c >>> index d745770dc4..b172a48b29 100644 >>> --- a/libavformat/vividas.c >>> +++ b/libavformat/vividas.c >>> @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, >>> unsigned *size, >>> uint8_t *buf; >>> uint8_t ibuf[8], sbuf[8]; >>> uint32_t k2; >>> - unsigned n; >>> + int n; >>> >> >> Why would that be better, when it's assigned a uint32_t? > > one (maybe not the only one) issue is > if (avio_read(src, buf+8, n) < n) { > > avio_read() returns int and has a int size > so this will not work at all with a unsigned int, not only will it not read > more than INT_MAX it also when it fails with an error fail to treat it as > an error > > do you prefer a diferent solution ? > ffio_read_size? Or just use != instead of <? Or check for n > INT_MAX before the call?
- Andreas _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
