har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/apngdec: Return error for incomplete header

Browse Source 
If avio_read() could read anything, it returns the number of bytes read,
even if it could not read as much as the caller desired.
apng_read_header() only checked the return value of its avio_read() calls
for being negative and this meant that it was possible for an incomplete
header to not be detected. The return value of the last successfull call
has been returned instead. This commit changes this.

Fixes: OOM
Fixes: 26608/clusterfuzz-testcase-minimized-ffmpeg_dem_APNG_fuzzer-4839491644424192

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 2cf1eefae5dba7a7259156f9ff5c62f4e4e2fe0d)
This commit is contained in:
Andreas Rheinhardt 2019-12-10 11:47:57 +01:00
parent b7ad5dbb5e
commit 8372a3b4b1
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavformat/apngdec.c
View File

@ -138,7 +138,7 @@ static int append_extradata(AVCodecParameters *par, AVIOContext *pb, int len)
par->extradata = new_extradata; par->extradata = new_extradata;
par->extradata_size = new_size; par->extradata_size = new_size;
if ((ret = avio_read(pb, par->extradata + previous_size, len)) < 0) if ((ret = ffio_read_size(pb, par->extradata + previous_size, len)) < 0)
return ret; return ret;
return previous_size; return previous_size;
@ -185,10 +185,10 @@ static int apng_read_header(AVFormatContext *s)
AV_WL32(st->codecpar->extradata+4, tag); AV_WL32(st->codecpar->extradata+4, tag);
AV_WB32(st->codecpar->extradata+8, st->codecpar->width); AV_WB32(st->codecpar->extradata+8, st->codecpar->width);
AV_WB32(st->codecpar->extradata+12, st->codecpar->height); AV_WB32(st->codecpar->extradata+12, st->codecpar->height);
if ((ret = avio_read(pb, st->codecpar->extradata+16, 9)) < 0) if ((ret = ffio_read_size(pb, st->codecpar->extradata + 16, 9)) < 0)
goto fail; return ret;
while (!avio_feof(pb)) { while (1) {
if (acTL_found && ctx->num_play != 1) { if (acTL_found && ctx->num_play != 1) {
int64_t size = avio_size(pb); int64_t size = avio_size(pb);
int64_t offset = avio_tell(pb); int64_t offset = avio_tell(pb);