Fixes: OOM Fixes: 50551/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6607795234930688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mxfdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 0553728253..64ac6a44b8 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -1943,6 +1943,10 @@ static int mxf_compute_ptses_fake_index(MXFContext *mxf, MXFIndexTable *index_ta } index_table->nb_ptses += s->index_duration; + // If index_duration is substantially larger than nb_index_entries then this algorithm which + // allocates index_duration elements is a bad idea. All files i tried have it equal + if (s->index_duration > 10LL * s->nb_index_entries) + return AVERROR_PATCHWELCOME; } /* paranoid check */ -- 2.17.1 _______________________________________________ ffmpeg-devel mailing list [email protected] https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email [email protected] with subject "unsubscribe".
