[FFmpeg-devel] [PATCH 1/2] avformat/matroskadec: Fix infinite loop with bz decompression

[Michael Niedermayer]

On Fri, Feb 04, 2022 at 04:07:10PM +0100, Michael Niedermayer wrote:
> On Fri, Feb 04, 2022 at 04:29:18AM +0100, Andreas Rheinhardt wrote:
> > Michael Niedermayer:
> > > Fixes: Infinite loop
> > > Fixes: 43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624
> > > 
> > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > > ---
> > >  libavformat/matroskadec.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
> > > index d165f6ab90..5a9acfb247 100644
> > > --- a/libavformat/matroskadec.c
> > > +++ b/libavformat/matroskadec.c
> > > @@ -1742,7 +1742,7 @@ static int matroska_decode_buffer(uint8_t **buf, int *buf_size,
> > >      case MATROSKA_TRACK_ENCODING_COMP_BZLIB:
> > >      {
> > >          bz_stream bzstream = { 0 };
> > > -        if (BZ2_bzDecompressInit(&bzstream, 0, 0) != BZ_OK)
> > > +        if (!pkt_size || BZ2_bzDecompressInit(&bzstream, 0, 0) != BZ_OK)
> > >              return -1;
> > >          bzstream.next_in  = data;
> > >          bzstream.avail_in = isize;
> > 
> > I see nothing in the zlib-API manual that would preclude this from
> > happening with zlib, too, so it should be checked there, too.
> > LGTM apart from that.
> 
> It didnt happen with the same case when i just routed it to the zlib
> instead of bz case. But i didnt look what happened exactly

will apply with the check for zlib too, it feels like a good idea even when
it seems not needed

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The day soldiers stop bringing you their problems is the day you have stopped 
leading them. They have either lost confidence that you can help or concluded 
you do not care. Either case is a failure of leadership. - Colin Powell
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20220209/31b7697b/attachment.sig>