har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/mov: free the infe allocated item data on failure

Browse Source 
Fixes: memleak
Fixes: 68212/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4963488540721152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Tested-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit e09164940e4ff0b0ee9228f9d27385211160c6da)
This commit is contained in:
James Almer 2024-04-26 21:26:01 -03:00
parent 5683aa6318
commit 1e6382a6b7
1 changed files with 25 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
libavformat/mov.c
View File

@ -83,6 +83,7 @@ typedef struct MOVParseTableEntry {
static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom); static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom);
static int mov_read_mfra(MOVContext *c, AVIOContext *f); static int mov_read_mfra(MOVContext *c, AVIOContext *f);
static void mov_free_stream_context(AVFormatContext *s, AVStream *st);
static int64_t add_ctts_entry(MOVCtts** ctts_data, unsigned int* ctts_count, unsigned int* allocated_size, static int64_t add_ctts_entry(MOVCtts** ctts_data, unsigned int* ctts_count, unsigned int* allocated_size,
int count, int duration); int count, int duration);
@ -8131,6 +8132,7 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx)
if (version < 2) { if (version < 2) {
avpriv_report_missing_feature(c->fc, "infe version < 2"); avpriv_report_missing_feature(c->fc, "infe version < 2");
avio_skip(pb, size);
return 1; return 1;
} }
@ -8174,7 +8176,7 @@ static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom)
{ {
HEIFItem *heif_item; HEIFItem *heif_item;
int entry_count; int entry_count;
int version, ret; int version, got_stream = 0, ret, i;
if (c->found_iinf) { if (c->found_iinf) {
av_log(c->fc, AV_LOG_WARNING, "Duplicate iinf box found\n"); av_log(c->fc, AV_LOG_WARNING, "Duplicate iinf box found\n");
@ -8194,20 +8196,33 @@ static int mov_read_iinf(MOVContext *c, AVIOContext *pb, MOVAtom atom)
sizeof(*c->heif_item) * (entry_count - c->nb_heif_item)); sizeof(*c->heif_item) * (entry_count - c->nb_heif_item));
c->nb_heif_item = FFMAX(c->nb_heif_item, entry_count); c->nb_heif_item = FFMAX(c->nb_heif_item, entry_count);
for (int i = 0; i < entry_count; i++) { for (i = 0; i < entry_count; i++) {
MOVAtom infe; MOVAtom infe;
infe.size = avio_rb32(pb) - 8; infe.size = avio_rb32(pb) - 8;
infe.type = avio_rl32(pb); infe.type = avio_rl32(pb);
ret = mov_read_infe(c, pb, infe, i); ret = mov_read_infe(c, pb, infe, i);
if (ret < 0) if (ret < 0)
return ret; goto fail;
if (ret) if (!ret)
return 0; got_stream = 1;
} }
c->found_iinf = 1; c->found_iinf = got_stream;
return 0; return 0;
fail:
for (; i >= 0; i--) {
HEIFItem *item = &c->heif_item[i];
av_freep(&item->name);
if (!item->st)
continue;
mov_free_stream_context(c->fc, item->st);
ff_remove_stream(c->fc, item->st);
item->st = NULL;
}
return ret;
} }
static int mov_read_iref_dimg(MOVContext *c, AVIOContext *pb, int version) static int mov_read_iref_dimg(MOVContext *c, AVIOContext *pb, int version)
@ -9550,6 +9565,10 @@ static int mov_read_header(AVFormatContext *s)
return err; return err;
} }
} }
// prevent iloc and iinf boxes from being parsed while reading packets.
// this is needed because an iinf box may have been parsed but ignored
// for having old infe boxes which create no streams.
mov->found_iloc = mov->found_iinf = 1;
if (pb->seekable & AVIO_SEEKABLE_NORMAL) { if (pb->seekable & AVIO_SEEKABLE_NORMAL) {
if (mov->nb_chapter_tracks > 0 && !mov->ignore_chapters) if (mov->nb_chapter_tracks > 0 && !mov->ignore_chapters)