This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit ace9cc2cc9eaafa79182df20e731fbd3f3016ce7 Author: Kacper Michajłow <[email protected]> AuthorDate: Thu Oct 29 21:56:57 2026 +0100 Commit: Kacper Michajłow <[email protected]> CommitDate: Sat Oct 31 23:37:29 2026 +0000 avformat/vividas: allocate the SB entries per block track_index() allocated entries for the largest packet count in the index, up to INT_MAX, before any block was read. Allocate them in load_sb_block() for the loaded block and return its errors to the header, packet and seek callbacks, and skip a block that declares more packets than fit in it, as each entry takes at least two bytes. Fixes: OOM Fixes: clusterfuzz-testcase-fuzzer_protocol_lavf-6404424499789824 Found-by: https://github.com/google/oss-fuzz/tree/master/projects/mpv Signed-off-by: Kacper Michajłow <[email protected]> --- libavformat/vividas.c | 43 ++++++++++++++++++++++++++++--------------- 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/libavformat/vividas.c b/libavformat/vividas.c index 23f010d25c..faa1c65877 100644 --- a/libavformat/vividas.c +++ b/libavformat/vividas.c @@ -440,7 +440,6 @@ static int track_index(VividasDemuxContext *viv, AVFormatContext *s, { int64_t off; int64_t poff; - int maxnp=0; FFIOContext pb0; AVIOContext *const pb = &pb0.pub; int i; @@ -478,25 +477,18 @@ static int track_index(VividasDemuxContext *viv, AVFormatContext *s, off += viv->sb_blocks[i].size; poff += viv->sb_blocks[i].n_packets; - - if (maxnp < viv->sb_blocks[i].n_packets) - maxnp = viv->sb_blocks[i].n_packets; } if (filesize > 0 && poff > filesize) return AVERROR_INVALIDDATA; - viv->sb_entries = av_calloc(maxnp, sizeof(VIV_SB_entry)); - if (!viv->sb_entries) - return AVERROR(ENOMEM); - return 0; } -static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned expected_size) +static int load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned expected_size) { uint32_t size = 0; - int i; + int i, ret; AVIOContext *pb = 0; if (viv->sb_pb) { @@ -509,12 +501,12 @@ static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned viv->sb_buf = read_sb_block(s->pb, &size, &viv->sb_key, expected_size); if (!viv->sb_buf) { - return; + return AVERROR_INVALIDDATA; } pb = avio_alloc_context(viv->sb_buf, size, 0, NULL, NULL, NULL, NULL); if (!pb) - return; + return AVERROR(ENOMEM); viv->sb_pb = pb; @@ -526,6 +518,18 @@ static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned viv->n_sb_entries = viv->sb_blocks[viv->current_sb].n_packets; + // Each entry takes at least two bytes of the block. + if (viv->n_sb_entries > size / 2) { + viv->n_sb_entries = 0; + return 0; + } + ret = av_reallocp_array(&viv->sb_entries, viv->n_sb_entries, + sizeof(*viv->sb_entries)); + if (ret < 0) { + viv->n_sb_entries = 0; + return ret; + } + for (i = 0; i < viv->n_sb_entries; i++) { viv->sb_entries[i].size = ffio_read_varlen(pb); viv->sb_entries[i].flag = avio_r8(pb); @@ -535,6 +539,8 @@ static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned avio_r8(pb); viv->current_sb_entry = 0; + + return 0; } static int viv_read_header(AVFormatContext *s) @@ -628,7 +634,9 @@ static int viv_read_header(AVFormatContext *s) viv->sb_offset = avio_tell(pb); if (viv->n_sb_blocks > 0) { viv->current_sb = 0; - load_sb_block(s, viv, viv->sb_blocks[0].size); + ret = load_sb_block(s, viv, viv->sb_blocks[0].size); + if (ret < 0) + return ret; } else { viv->current_sb = -1; } @@ -675,7 +683,9 @@ static int viv_read_packet(AVFormatContext *s, return AVERROR_INVALIDDATA; viv->current_sb++; - load_sb_block(s, viv, 0); + ret = load_sb_block(s, viv, 0); + if (ret < 0) + return ret; viv->current_sb_entry = 0; } @@ -766,6 +776,7 @@ static int viv_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp { VividasDemuxContext *viv = s->priv_data; int64_t frame; + int ret; if (stream_index == 0) frame = timestamp; @@ -778,7 +789,9 @@ static int viv_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp // seek to ith sb block avio_seek(s->pb, viv->sb_offset + viv->sb_blocks[i].byte_offset, SEEK_SET); // load the block - load_sb_block(s, viv, 0); + ret = load_sb_block(s, viv, 0); + if (ret < 0) + return ret; if (viv->num_audio) { const AVCodecParameters *par = s->streams[1]->codecpar; // flush audio packet queue -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
