mirrors/librempeg
1
0
Fork 0
mirror of https://github.com/librempeg/librempeg synced 2024-11-22 09:02:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/jpegxl_anim_dec: Check that size fits within argument

Browse Source 
Fixes: out of array access
Fixes: 61991/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5524679648215040
Fixes: 62181/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5504964305485824
Fixes: 62214/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-4782972823535616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-09-10 02:28:05 +02:00
parent 00a837c70c
commit d2e8974699
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/jpegxl_anim_dec.c
View File

@ -152,6 +152,8 @@ static int jpegxl_anim_read_packet(AVFormatContext *s, AVPacket *pkt)
size = avio_size(pb);
if (size < 0)
return size;
if (size > INT_MAX)
return AVERROR(EDOM);
if (size == 0)
size = 4096;