[FFmpeg-devel] [PATCH 5/7] avformat/mpegts: Limit copied data to space

[Michael Niedermayer]

On Wed, Nov 04, 2020 at 11:17:53PM +0100, Marton Balint wrote:
> 
> 
> On Wed, 4 Nov 2020, Michael Niedermayer wrote:
> 
> > Fixes: out of array access
> > Fixes: 26816/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-6282861159907328.fuzz
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> > libavformat/mpegts.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
> > index ebb09991dc..80d010db6c 100644
> > --- a/libavformat/mpegts.c
> > +++ b/libavformat/mpegts.c
> > @@ -3169,7 +3169,7 @@ static int mpegts_raw_read_packet(AVFormatContext *s, AVPacket *pkt)
> >         return ret;
> >     }
> >     if (data != pkt->data)
> > -        memcpy(pkt->data, data, ts->raw_packet_size);
> > +        memcpy(pkt->data, data, TS_PACKET_SIZE);
> >     finished_reading_packet(s, ts->raw_packet_size);
> >     if (ts->mpeg2ts_compute_pcr) {
> >         /* compute exact PCR for each packet */
> 
> LGTM, thanks.

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The real ebay dictionary, page 1
"Used only once"    - "Some unspecified defect prevented a second use"
"In good condition" - "Can be repaird by experienced expert"
"As is" - "You wouldnt want it even if you were payed for it, if you knew ..."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20201107/1740aab2/attachment.sig>