avformat/vividas: Check if extradata was read successfully
authorMichael Niedermayer <michael@niedermayer.cc>
Sat, 13 Jul 2019 18:08:03 +0000 (20:08 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Sat, 3 Aug 2019 15:44:23 +0000 (17:44 +0200)
Fixes: OOM
Fixes: 15575/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5654666781655040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/vividas.c

index 830e318..c0d39f0 100644 (file)
@@ -386,7 +386,12 @@ static void track_header(VividasDemuxContext *viv, AVFormatContext *s,  uint8_t
                 offset += av_xiphlacing(&p[offset], data_len[j]);
 
             for (j = 0; j < num_data; j++) {
-                avio_read(pb, &p[offset], data_len[j]);
+                int ret = avio_read(pb, &p[offset], data_len[j]);
+                if (ret < data_len[j]) {
+                    st->codecpar->extradata_size = 0;
+                    av_freep(&st->codecpar->extradata);
+                    break;
+                }
                 offset += data_len[j];
             }