On 12/26/2019 1:30 PM, James Almer wrote: > On 12/26/2019 1:24 PM, Lynne wrote: >> Dec 26, 2019, 13:57 by d...@lynne.ee: >> >>> Dec 16, 2019, 23:19 by mich...@niedermayer.cc: >>> >>>> Fixes: out of array read >>>> Fixes: >>>> 19327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5679823087468544 >>>> >>>> Found-by: continuous fuzzing process >>>> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg >>>> Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> >>>> >> >> Actually nevermind, patch is good as-is. I think a 0 len just means to reuse >> the parameters from the previous. So clipping them should be fine. >> You should replace the FFMIN(val, (len << 1) - 1) with a av_clip_uintp2(val, >> len) which does exactly that. > > I guess he didn't use it because c->band_ext_data is an int array. A > quick look at the code shows it apparently can't be negative, so > av_clip_uintp2() should be safe, but maybe the type should be changed to > unsigned to avoid confusion.
Nevermind, didn't realize av_clip_uintp2() takes ints as input arguments. _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
