avformat/vividas: Fix infinite loop in header parser
authorMichael Niedermayer <michael@niedermayer.cc>
Sat, 10 Aug 2019 21:09:46 +0000 (23:09 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Sun, 11 Aug 2019 17:13:21 +0000 (19:13 +0200)
Fixes: Timeout (Infinite -> Finite)
Fixes: 16010/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5638616102993920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/vividas.c

index e70c916..a5f3318 100644 (file)
@@ -546,6 +546,9 @@ static int viv_read_header(AVFormatContext *s)
             break;
 
         block_len = ffio_read_varlen(pb);
+        if (avio_feof(pb))
+            return AVERROR_INVALIDDATA;
+
         block_type = avio_r8(pb);
 
         if (block_type == 22) {