Fixes: Assertion klv_offset >= mxf->run_in failed at libavformat/mxfdec.c:736 Fixes: 62936/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5778404366221312.fuzz
Unified · Split
| @@ -458,12 +458,15 @@ static int mxf_read_sync(AVIOContext *pb, const uint8_t *key, unsigned size) · 457 unmodified lines | ||
| 458 | 458 | return i == size; |
| 459 | 459 | } |
| 460 | 460 | |
| 461 | −static int klv_read_packet(KLVPacket *klv, AVIOContext *pb) | |
| 461 | +static int klv_read_packet(MXFContext *mxf, KLVPacket *klv, AVIOContext *pb) | |
| 462 | 462 | { |
| 463 | 463 | int64_t length, pos; |
| 464 | 464 | if (!mxf_read_sync(pb, mxf_klv_key, 4)) |
| 465 | 465 | return AVERROR_INVALIDDATA; |
| 466 | 466 | klv->offset = avio_tell(pb) - 4; |
| 467 | + if (klv->offset < mxf->run_in) | |
| 468 | + return AVERROR_INVALIDDATA; | |
| 469 | + | |
| 467 | 470 | memcpy(klv->key, mxf_klv_key, 4); |
| 468 | 471 | avio_read(pb, klv->key + 4, 12); |
| 469 | 472 | length = klv_decode_ber_length(pb); |
| @@ -3435,7 +3438,7 @@ static int mxf_seek_to_previous_partition(MXFContext *mxf) · 2965 unmodified lines | ||
| 3435 | 3438 | /* Make sure this is actually a PartitionPack, and if so parse it. |
| 3436 | 3439 | * See deadlock2.mxf |
| 3437 | 3440 | */ |
| 3438 | − if ((ret = klv_read_packet(&klv, pb)) < 0) { | |
| 3441 | + if ((ret = klv_read_packet(mxf, &klv, pb)) < 0) { | |
| 3439 | 3442 | av_log(mxf->fc, AV_LOG_ERROR, "failed to read PartitionPack KLV\n"); |
| 3440 | 3443 | return ret; |
| 3441 | 3444 | } |
| @@ -3712,7 +3715,7 @@ static void mxf_read_random_index_pack(AVFormatContext *s) · 270 unmodified lines | ||
| 3712 | 3715 | if (length < min_rip_length || length > max_rip_length) |
| 3713 | 3716 | goto end; |
| 3714 | 3717 | avio_seek(s->pb, file_size - length, SEEK_SET); |
| 3715 | − if (klv_read_packet(&klv, s->pb) < 0 || | |
| 3718 | + if (klv_read_packet(mxf, &klv, s->pb) < 0 || | |
| 3716 | 3719 | !IS_KLV_KEY(klv.key, ff_mxf_random_index_pack_key)) |
| 3717 | 3720 | goto end; |
| 3718 | 3721 | if (klv.next_klv != file_size || klv.length <= 4 || (klv.length - 4) % 12) { |
| @@ -3759,7 +3762,7 @@ static int mxf_read_header(AVFormatContext *s) · 40 unmodified lines | ||
| 3759 | 3762 | while (!avio_feof(s->pb)) { |
| 3760 | 3763 | const MXFMetadataReadTableEntry *metadata; |
| 3761 | 3764 | |
| 3762 | − ret = klv_read_packet(&klv, s->pb); | |
| 3765 | + ret = klv_read_packet(mxf, &klv, s->pb); | |
| 3763 | 3766 | if (ret < 0 || IS_KLV_KEY(klv.key, ff_mxf_random_index_pack_key)) { |
| 3764 | 3767 | if (ret >= 0 && avio_size(s->pb) > klv.next_klv) |
| 3765 | 3768 | av_log(s, AV_LOG_WARNING, "data after the RandomIndexPack, assuming end of file\n"); |
| @@ -4011,7 +4014,7 @@ static int mxf_read_packet(AVFormatContext *s, AVPacket *pkt) · 245 unmodified lines | ||
| 4011 | 4014 | |
| 4012 | 4015 | if (pos < mxf->current_klv_data.next_klv - mxf->current_klv_data.length || pos >= mxf->current_klv_data.next_klv) { |
| 4013 | 4016 | mxf->current_klv_data = (KLVPacket){{0}}; |
| 4014 | − ret = klv_read_packet(&klv, s->pb); | |
| 4017 | + ret = klv_read_packet(mxf, &klv, s->pb); | |
| 4015 | 4018 | if (ret < 0) |
| 4016 | 4019 | break; |
| 4017 | 4020 | max_data_size = klv.length; |