[FFmpeg-cvslog] avformat/mxfdec: Check body_offset

2024-06-14 Thread Michael Niedermayer 
ffmpeg | branch: release/4.3 | Michael Niedermayer  | 
Fri Apr 26 03:46:33 2024 +0200| [2a49bf571379eda59faf1d19e14945974ad85502] | 
committer: Michael Niedermayer

avformat/mxfdec: Check body_offset

Fixes: signed integer overflow: 538976288 - -9223372036315799520 cannot be 
represented in type 'long'
Fixes: 
68060/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5523457266745344

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 20a6bfda0f7c6447ac94611736cee6e9ce6972a0)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2a49bf571379eda59faf1d19e14945974ad85502
---

 libavformat/mxfdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 342ec122de..2d7937b6e5 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -721,6 +721,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext 
*pb, int tag, int size
 partition->index_sid = avio_rb32(pb);
 partition->body_offset = avio_rb64(pb);
 partition->body_sid = avio_rb32(pb);
+if (partition->body_offset < 0)
+return AVERROR_INVALIDDATA;
+
 if (avio_read(pb, op, sizeof(UID)) != sizeof(UID)) {
 av_log(mxf->fc, AV_LOG_ERROR, "Failed reading UID\n");
 return AVERROR_INVALIDDATA;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mxfdec: Check body_offset

2024-06-13 Thread Michael Niedermayer 
ffmpeg | branch: release/5.1 | Michael Niedermayer  | 
Fri Apr 26 03:46:33 2024 +0200| [a17885a73d373a1d15fdcbd55a6b1e9cf0f40209] | 
committer: Michael Niedermayer

avformat/mxfdec: Check body_offset

Fixes: signed integer overflow: 538976288 - -9223372036315799520 cannot be 
represented in type 'long'
Fixes: 
68060/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5523457266745344

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 20a6bfda0f7c6447ac94611736cee6e9ce6972a0)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a17885a73d373a1d15fdcbd55a6b1e9cf0f40209
---

 libavformat/mxfdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 5c7acb5d00..c31f88bee9 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -778,6 +778,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext 
*pb, int tag, int size
 partition->index_sid = avio_rb32(pb);
 partition->body_offset = avio_rb64(pb);
 partition->body_sid = avio_rb32(pb);
+if (partition->body_offset < 0)
+return AVERROR_INVALIDDATA;
+
 if (avio_read(pb, op, sizeof(UID)) != sizeof(UID)) {
 av_log(mxf->fc, AV_LOG_ERROR, "Failed reading UID\n");
 return AVERROR_INVALIDDATA;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mxfdec: Check body_offset

2024-05-24 Thread Michael Niedermayer 
ffmpeg | branch: release/6.1 | Michael Niedermayer  | 
Fri Apr 26 03:46:33 2024 +0200| [19e6b871b6c1fd02deb96898d6660857a3952f82] | 
committer: Michael Niedermayer

avformat/mxfdec: Check body_offset

Fixes: signed integer overflow: 538976288 - -9223372036315799520 cannot be 
represented in type 'long'
Fixes: 
68060/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5523457266745344

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 20a6bfda0f7c6447ac94611736cee6e9ce6972a0)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=19e6b871b6c1fd02deb96898d6660857a3952f82
---

 libavformat/mxfdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index f5215b0163..de78b781d4 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -791,6 +791,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext 
*pb, int tag, int size
 partition->index_sid = avio_rb32(pb);
 partition->body_offset = avio_rb64(pb);
 partition->body_sid = avio_rb32(pb);
+if (partition->body_offset < 0)
+return AVERROR_INVALIDDATA;
+
 if (avio_read(pb, op, sizeof(UID)) != sizeof(UID)) {
 av_log(mxf->fc, AV_LOG_ERROR, "Failed reading UID\n");
 return AVERROR_INVALIDDATA;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mxfdec: Check body_offset

2024-05-22 Thread Michael Niedermayer 
ffmpeg | branch: release/7.0 | Michael Niedermayer  | 
Fri Apr 26 03:46:33 2024 +0200| [0e44de3b9b5c7dc99b47c30d24932d9856d3b646] | 
committer: Michael Niedermayer

avformat/mxfdec: Check body_offset

Fixes: signed integer overflow: 538976288 - -9223372036315799520 cannot be 
represented in type 'long'
Fixes: 
68060/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5523457266745344

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 20a6bfda0f7c6447ac94611736cee6e9ce6972a0)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0e44de3b9b5c7dc99b47c30d24932d9856d3b646
---

 libavformat/mxfdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 4e4beb40b0..518a507539 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -790,6 +790,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext 
*pb, int tag, int size
 partition->index_sid = avio_rb32(pb);
 partition->body_offset = avio_rb64(pb);
 partition->body_sid = avio_rb32(pb);
+if (partition->body_offset < 0)
+return AVERROR_INVALIDDATA;
+
 if (avio_read(pb, op, sizeof(UID)) != sizeof(UID)) {
 av_log(mxf->fc, AV_LOG_ERROR, "Failed reading UID\n");
 return AVERROR_INVALIDDATA;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mxfdec: Check body_offset

2024-04-30 Thread Michael Niedermayer 
ffmpeg | branch: master | Michael Niedermayer  | Fri 
Apr 26 03:46:33 2024 +0200| [20a6bfda0f7c6447ac94611736cee6e9ce6972a0] | 
committer: Michael Niedermayer

avformat/mxfdec: Check body_offset

Fixes: signed integer overflow: 538976288 - -9223372036315799520 cannot be 
represented in type 'long'
Fixes: 
68060/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5523457266745344

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin 
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=20a6bfda0f7c6447ac94611736cee6e9ce6972a0
---

 libavformat/mxfdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 233d614f78..e65cec74c2 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -791,6 +791,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext 
*pb, int tag, int size
 partition->index_sid = avio_rb32(pb);
 partition->body_offset = avio_rb64(pb);
 partition->body_sid = avio_rb32(pb);
+if (partition->body_offset < 0)
+return AVERROR_INVALIDDATA;
+
 if (avio_read(pb, op, sizeof(UID)) != sizeof(UID)) {
 av_log(mxf->fc, AV_LOG_ERROR, "Failed reading UID\n");
 return AVERROR_INVALIDDATA;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".