For the final input in a file, the while loop above will not break and
as a result
data + sizeof(fuzz_tag) == end
when it exits. There is an off-by-one error in the changed line,
which is meant to handle this case. The result is that the final 8
bytes of all input files are skipped.
Signed-off-by: Frank Plowman <p...@frankplowman.com>
---
tools/target_bsf_fuzzer.c | 2 +-
tools/target_dec_fuzzer.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/target_bsf_fuzzer.c b/tools/target_bsf_fuzzer.c
index 44a4d1467d..c3761bb33e 100644
--- a/tools/target_bsf_fuzzer.c
+++ b/tools/target_bsf_fuzzer.c
@@ -131,7 +131,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t
size) {
break;
data++;
}
- if (data + sizeof(fuzz_tag) > end)
+ if (data + sizeof(fuzz_tag) >= end)
data = end;
res = av_new_packet(pkt, data - last);
diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c
index 794b5b92cc..550d34fc61 100644
--- a/tools/target_dec_fuzzer.c
+++ b/tools/target_dec_fuzzer.c
@@ -485,7 +485,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t
size) {
break;
data++;
}
- if (data + sizeof(fuzz_tag) > end)
+ if (data + sizeof(fuzz_tag) >= end)
data = end;
res = av_new_packet(parsepkt, data - last);
--
2.46.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
