avformat/icodec: Fix crash probing fuzzed file
authorMark Harris <mark.hsj@gmail.com>
Tue, 16 Feb 2016 07:52:13 +0000 (23:52 -0800)
committerAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Sat, 26 Nov 2016 23:38:58 +0000 (00:38 +0100)
Avoid invalid memory read/crash when frame offset >= 0xfffffff8.
Base64-encoded example: AAABADAwMDAwMAAAMAAwMDAw/P///w==
(The previous commit verifies that p->buf_size >= 22.)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56e2cd9c042e05255aa28487694c29aaec023263)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
libavformat/icodec.c

index 20721d5..bd83ef4 100644 (file)
@@ -60,7 +60,7 @@ static int probe(AVProbeData *p)
         offset = AV_RL32(p->buf + 18 + i * 16);
         if (offset < 22)
             return FFMIN(i, AVPROBE_SCORE_MAX / 4);
-        if (offset + 8 > p->buf_size)
+        if (offset > p->buf_size - 8)
             return AVPROBE_SCORE_MAX / 4 + FFMIN(i, 1);
         if (p->buf[offset] != 40 && AV_RB64(p->buf + offset) != PNGSIG)
             return FFMIN(i, AVPROBE_SCORE_MAX / 4);