[FFmpeg-devel] [PATCH] avformat/ape: Error out in case of EOF in the header

[Andreas Rheinhardt]

Michael Niedermayer:
> Fixes: OOM
> Fixes: 24375/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6216862443241472
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavformat/ape.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/libavformat/ape.c b/libavformat/ape.c
> index 39a584aa98..e966063ad7 100644
> --- a/libavformat/ape.c
> +++ b/libavformat/ape.c
> @@ -253,7 +253,7 @@ static int ape_read_header(AVFormatContext * s)
>              avio_skip(pb, ape->wavheaderlength);
>      }
>  
> -    if(!ape->totalframes){
> +    if(!ape->totalframes || pb->eof_reached){
>          av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
>          return AVERROR(EINVAL);
>      }
> @@ -298,8 +298,10 @@ static int ape_read_header(AVFormatContext * s)
>              for (i = 0; i < ape->totalframes && !pb->eof_reached; i++)
>                  ape->bittable[i] = avio_r8(pb);
>          }
> -        if (pb->eof_reached)
> -            av_log(s, AV_LOG_WARNING, "File truncated\n");
> +        if (pb->eof_reached) {
> +            av_log(s, AV_LOG_ERROR, "File truncated\n");
> +            return AVERROR_INVALIDDATA;
> +        }

The above will lead to a memleak as long as cleaning up on read_header
failure is not automatic. Furthermore, it's the first of the checks that
fixes the OOM scenario, not the second, isn't it?

- Andreas

PS: One could remove the allocations for seek- and bittable altogether;
only ape_dumpinfo() needs to have the seektable, the bittable as well as
the frames at the same time.