This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 5442733480f004f5d14323c698e7ded11e24c289 Author: Kacper Michajłow <[email protected]> AuthorDate: Thu Oct 29 21:56:57 2026 +0100 Commit: Kacper Michajłow <[email protected]> CommitDate: Sat Oct 31 23:37:29 2026 +0000 avformat/nsvdec: do not allocate the declared info strings size The NSVf header declares the size of its info strings, up to 2 GiB, and the buffer was allocated and zeroed before reading them, also when the file is much shorter. Read them with avio_read_to_bprint(), which allocates as the data arrives. Fixes: OOM Fixes: clusterfuzz-testcase-fuzzer_protocol_memory-6327893299625984 Fixes: clusterfuzz-testcase-fuzzer_protocol_edl-5153066277208064 Found-by: https://github.com/google/oss-fuzz/tree/master/projects/mpv Signed-off-by: Kacper Michajłow <[email protected]> --- libavformat/nsvdec.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c index 9b945a7c12..b18fc46a4e 100644 --- a/libavformat/nsvdec.c +++ b/libavformat/nsvdec.c @@ -22,6 +22,7 @@ */ #include "libavutil/attributes.h" +#include "libavutil/bprint.h" #include "libavutil/mathematics.h" #include "libavutil/mem.h" #include "avformat.h" @@ -301,16 +302,20 @@ static int nsv_parse_NSVf_header(AVFormatContext *s) av_log(s, AV_LOG_TRACE, "NSV got header; filepos %"PRId64"\n", avio_tell(pb)); if (strings_size > 0) { - char *strings; /* last byte will be '\0' to play safe with str*() */ + AVBPrint strings; char *p, *endp; char *token, *value; char quote; + int ret; - p = strings = av_mallocz((size_t)strings_size + 1); - if (!p) - return AVERROR(ENOMEM); - endp = strings + strings_size; - avio_read(pb, strings, strings_size); + av_bprint_init(&strings, 0, AV_BPRINT_SIZE_UNLIMITED); + ret = avio_read_to_bprint(pb, &strings, strings_size); + if (ret < 0) { + av_bprint_finalize(&strings, NULL); + return ret; + } + p = strings.str; + endp = strings.str + strings.len; while (p < endp) { while (*p == ' ') p++; /* strip out spaces */ @@ -330,7 +335,7 @@ static int nsv_parse_NSVf_header(AVFormatContext *s) av_log(s, AV_LOG_TRACE, "NSV NSVf INFO: %s='%s'\n", token, value); av_dict_set(&s->metadata, token, value, 0); } - av_free(strings); + av_bprint_finalize(&strings, NULL); } if (avio_feof(pb)) return -1; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
