提交 8edfd059 编写于 作者: M Michael Niedermayer

avformat/oggdec: Do not hardcode arbitrary and sometimes unavailable size

Fixes: regression since e983197c
Fixes: out of array read
Fixes: 22185/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5662069073641472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: NLynne <dev@lynne.ee>
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>
上级 108ee4b4
......@@ -206,7 +206,7 @@ static const struct ogg_codec *ogg_find_codec(uint8_t *buf, int size)
* situation where a new audio stream spawn (identified with a new serial) and
* must replace the previous one (track switch).
*/
static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic,
static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic, int page_size,
int probing)
{
struct ogg *ogg = s->priv_data;
......@@ -220,7 +220,7 @@ static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic,
}
/* Check for codecs */
codec = ogg_find_codec(magic, 8);
codec = ogg_find_codec(magic, page_size);
if (!codec && !probing) {
av_log(s, AV_LOG_ERROR, "Cannot identify new stream\n");
return AVERROR_INVALIDDATA;
......@@ -430,7 +430,7 @@ static int ogg_read_page(AVFormatContext *s, int *sid, int probing)
/* CRC is correct so we can be 99% sure there's an actual change here */
if (idx < 0) {
if (data_packets_seen(ogg))
idx = ogg_replace_stream(s, serial, readout_buf, probing);
idx = ogg_replace_stream(s, serial, readout_buf, size, probing);
else
idx = ogg_new_stream(s, serial);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册