[FFmpeg-devel] [PATCH 6/6] avformat/flvdec: Check for EOF in loop in flv_data_packet()

[Michael Niedermayer]

Fixes: Timeout
Fixes: 29656/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-5840098987999232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavformat/flvdec.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
index 4bc5e15dd2..02797e1fba 100644
--- a/libavformat/flvdec.c
+++ b/libavformat/flvdec.c
@@ -909,6 +909,11 @@ static int flv_data_packet(AVFormatContext *s, AVPacket *pkt,
 
     while (array || (ret = amf_get_string(pb, buf, sizeof(buf))) > 0) {
         AMFDataType type = avio_r8(pb);
+        if (avio_feof(pb)) {
+            ret = AVERROR_INVALIDDATA;
+            goto skip;
+        }
+
         if (type == AMF_DATA_TYPE_STRING && (array || !strcmp(buf, "text"))) {
             length = avio_rb16(pb);
             ret    = av_get_packet(pb, pkt, length);
-- 
2.17.1