ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-09-19 21:06:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/asfdec_o: limit recursion depth in asf_read_unknown()

Browse Source 
The threshold of 5 is arbitrary, both smaller and larger should work fine

Fixes: Stack overflow
Fixes: 50603/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6049302564175872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-08-31 01:21:38 +02:00
parent 4a054c3e97
commit 1f1a368169
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavformat/asfdec_o.c
View File

@ -109,6 +109,7 @@ typedef struct ASFContext {
int64_t data_offset; int64_t data_offset;
int64_t first_packet_offset; // packet offset int64_t first_packet_offset; // packet offset
int64_t unknown_offset; // for top level header objects or subobjects without specified behavior int64_t unknown_offset; // for top level header objects or subobjects without specified behavior
int in_asf_read_unknown;
// ASF file must not contain more than 128 streams according to the specification // ASF file must not contain more than 128 streams according to the specification
ASFStream *asf_st[ASF_MAX_STREAMS]; ASFStream *asf_st[ASF_MAX_STREAMS];
@ -173,7 +174,7 @@ static int asf_read_unknown(AVFormatContext *s, const GUIDParseTable *g)
uint64_t size = avio_rl64(pb); uint64_t size = avio_rl64(pb);
int ret; int ret;
if (size > INT64_MAX) if (size > INT64_MAX || asf->in_asf_read_unknown > 5)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if (asf->is_header) if (asf->is_header)
@ -182,8 +183,11 @@ static int asf_read_unknown(AVFormatContext *s, const GUIDParseTable *g)
if (!g->is_subobject) { if (!g->is_subobject) {
if (!(ret = strcmp(g->name, "Header Extension"))) if (!(ret = strcmp(g->name, "Header Extension")))
avio_skip(pb, 22); // skip reserved fields and Data Size avio_skip(pb, 22); // skip reserved fields and Data Size
if ((ret = detect_unknown_subobject(s, asf->unknown_offset, asf->in_asf_read_unknown ++;
asf->unknown_size)) < 0) ret = detect_unknown_subobject(s, asf->unknown_offset,
asf->unknown_size);
asf->in_asf_read_unknown --;
if (ret < 0)
return ret; return ret;
} else { } else {
if (size < 24) { if (size < 24) {