On 12/26/2019 1:24 PM, Lynne wrote: > Dec 26, 2019, 13:57 by [email protected]: > >> Dec 16, 2019, 23:19 by [email protected]: >> >>> Fixes: out of array read >>> Fixes: >>> 19327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5679823087468544 >>> >>> Found-by: continuous fuzzing process >>> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg >>> Signed-off-by: Michael Niedermayer <[email protected]> >>> > > Actually nevermind, patch is good as-is. I think a 0 len just means to reuse > the parameters from the previous. So clipping them should be fine. > You should replace the FFMIN(val, (len << 1) - 1) with a av_clip_uintp2(val, > len) which does exactly that.
I guess he didn't use it because c->band_ext_data is an int array. A quick look at the code shows it apparently can't be negative, so av_clip_uintp2() should be safe, but maybe the type should be changed to unsigned to avoid confusion. > _______________________________________________ > ffmpeg-devel mailing list > [email protected] > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > [email protected] with subject "unsubscribe". > _______________________________________________ ffmpeg-devel mailing list [email protected] https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email [email protected] with subject "unsubscribe".
