[FFmpeg-cvslog] avcodec/avpacket: Limit iterations in ff_packet_split_and_drop_side_data()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sun Jun 11 22:08:04 2017 +0200| [07339a45a04e5fa0848937090511d69a39a04740] | committer: Michael Niedermayer

avcodec/avpacket: Limit iterations in ff_packet_split_and_drop_side_data()

This avoids scaning beyond what a valid packet can contain
Fixes: Timeout
Fixes: 541/clusterfuzz-testcase-610189291657625

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=07339a45a04e5fa0848937090511d69a39a04740
---

 libavcodec/avpacket.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c
index a04cdaf530..5ce3228166 100644
--- a/libavcodec/avpacket.c
+++ b/libavcodec/avpacket.c
@@ -495,6 +495,8 @@ int ff_packet_split_and_drop_side_data(AVPacket *pkt){
             if (p - pkt->data < size + 5)
                 return 0;
             p-= size+5;
+            if (i > AV_PKT_DATA_NB)
+                return 0;
         }
         pkt->size = p - pkt->data - size;
         av_assert0(pkt->size >= 0);