[FFmpeg-devel] [PATCH] avformat/vividas: Use signed n in read_sb_block()
Andreas Rheinhardt
andreas.rheinhardt at gmail.com
Thu Feb 25 22:59:40 EET 2021
Michael Niedermayer:
> On Wed, Feb 24, 2021 at 03:23:40PM +0100, Anton Khirnov wrote:
>> Quoting Michael Niedermayer (2021-02-15 21:31:23)
>>> Fixes: OOM
>>> Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688
>>>
>>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
>>> ---
>>> libavformat/vividas.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/libavformat/vividas.c b/libavformat/vividas.c
>>> index d745770dc4..b172a48b29 100644
>>> --- a/libavformat/vividas.c
>>> +++ b/libavformat/vividas.c
>>> @@ -235,7 +235,7 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned *size,
>>> uint8_t *buf;
>>> uint8_t ibuf[8], sbuf[8];
>>> uint32_t k2;
>>> - unsigned n;
>>> + int n;
>>>
>>
>> Why would that be better, when it's assigned a uint32_t?
>
> one (maybe not the only one) issue is
> if (avio_read(src, buf+8, n) < n) {
>
> avio_read() returns int and has a int size
> so this will not work at all with a unsigned int, not only will it not read
> more than INT_MAX it also when it fails with an error fail to treat it as
> an error
>
> do you prefer a diferent solution ?
>
ffio_read_size? Or just use != instead of <? Or check for n > INT_MAX
before the call?
- Andreas
More information about the ffmpeg-devel
mailing list