[FFmpeg-devel] [PATCH] avformat/electronicarts: Check if there are any streams

[Michael Niedermayer]

On Sun, Sep 06, 2020 at 08:50:02PM -0300, James Almer wrote:
> On 9/6/2020 7:57 PM, Michael Niedermayer wrote:
> > Fixes: Assertion failure (invalid stream index)
> > Fixes: 25120/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6565251898933248
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavformat/electronicarts.c | 14 ++++++++------
> >  1 file changed, 8 insertions(+), 6 deletions(-)
> > 
> > diff --git a/libavformat/electronicarts.c b/libavformat/electronicarts.c
> > index 2ee5e1b6fa..6976a133c3 100644
> > --- a/libavformat/electronicarts.c
> > +++ b/libavformat/electronicarts.c
> > @@ -530,20 +530,17 @@ static int ea_read_header(AVFormatContext *s)
> >          if (ea->num_channels <= 0 || ea->num_channels > 2) {
> >              av_log(s, AV_LOG_WARNING,
> >                     "Unsupported number of channels: %d\n", ea->num_channels);
> > -            ea->audio_codec = 0;
> > -            return 1;
> > +            goto no_audio;
> >          }
> >          if (ea->sample_rate <= 0) {
> >              av_log(s, AV_LOG_ERROR,
> >                     "Unsupported sample rate: %d\n", ea->sample_rate);
> > -            ea->audio_codec = 0;
> > -            return 1;
> > +            goto no_audio;
> >          }
> >          if (ea->bytes <= 0 || ea->bytes > 2) {
> >              av_log(s, AV_LOG_ERROR,
> >                     "Invalid number of bytes per sample: %d\n", ea->bytes);
> > -            ea->audio_codec = AV_CODEC_ID_NONE;
> > -            return 1;
> > +            goto no_audio;
> >          }
> >  
> >          /* initialize the audio decoder stream */
> > @@ -564,8 +561,13 @@ static int ea_read_header(AVFormatContext *s)
> >                                                st->codecpar->bits_per_coded_sample;
> >          ea->audio_stream_index           = st->index;
> >          st->start_time                   = 0;
> > +        return 1;
> 
> fwiw, return value for AVInputFormat.read_header() should be 0 for
> success, < 0 for failure (Mind, while > 0 is not defined, it's currently
> treated like 0).

indeed, this is just for the internal function pointer though, doesnt affect
the user API visible one. But ill fix this.
Will do it in a seperate comit as this is unrelated to this patch, this just
moved some of the return 1 around.

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

No snowflake in an avalanche ever feels responsible. -- Voltaire
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20200908/501412d8/attachment.sig>