Fixes: Assertion klv_offset >= mxf->run_in failed at libavformat/mxfdec.c:736 Fixes: 62936/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5778404366221312.fuzz
Unified · Split
| @@ -458,12 +458,15 @@ static int mxf_read_sync(AVIOContext *pb, const uint8_t *key, unsigned size) · 457 unmodified lines | |||
| 458 | return i == size; | 458 | return i == size; |
| 459 | } | 459 | } |
| 460 | 460 | ||
| 461 | static int klv_read_packet(KLVPacket *klv, AVIOContext *pb) | 461 | static int klv_read_packet(MXFContext *mxf, KLVPacket *klv, AVIOContext *pb) |
| 462 | { | 462 | { |
| 463 | int64_t length, pos; | 463 | int64_t length, pos; |
| 464 | if (!mxf_read_sync(pb, mxf_klv_key, 4)) | 464 | if (!mxf_read_sync(pb, mxf_klv_key, 4)) |
| 465 | return AVERROR_INVALIDDATA; | 465 | return AVERROR_INVALIDDATA; |
| 466 | klv->offset = avio_tell(pb) - 4; | 466 | klv->offset = avio_tell(pb) - 4; |
| 467 | if (klv->offset < mxf->run_in) | ||
| 468 | return AVERROR_INVALIDDATA; | ||
| 469 | |||
| 467 | memcpy(klv->key, mxf_klv_key, 4); | 470 | memcpy(klv->key, mxf_klv_key, 4); |
| 468 | avio_read(pb, klv->key + 4, 12); | 471 | avio_read(pb, klv->key + 4, 12); |
| 469 | length = klv_decode_ber_length(pb); | 472 | length = klv_decode_ber_length(pb); |
| @@ -3435,7 +3438,7 @@ static int mxf_seek_to_previous_partition(MXFContext *mxf) · 2965 unmodified lines | |||
| 3435 | /* Make sure this is actually a PartitionPack, and if so parse it. | 3438 | /* Make sure this is actually a PartitionPack, and if so parse it. |
| 3436 | * See deadlock2.mxf | 3439 | * See deadlock2.mxf |
| 3437 | */ | 3440 | */ |
| 3438 | if ((ret = klv_read_packet(&klv, pb)) < 0) { | 3441 | if ((ret = klv_read_packet(mxf, &klv, pb)) < 0) { |
| 3439 | av_log(mxf->fc, AV_LOG_ERROR, "failed to read PartitionPack KLV\n"); | 3442 | av_log(mxf->fc, AV_LOG_ERROR, "failed to read PartitionPack KLV\n"); |
| 3440 | return ret; | 3443 | return ret; |
| 3441 | } | 3444 | } |
| @@ -3712,7 +3715,7 @@ static void mxf_read_random_index_pack(AVFormatContext *s) · 270 unmodified lines | |||
| 3712 | if (length < min_rip_length || length > max_rip_length) | 3715 | if (length < min_rip_length || length > max_rip_length) |
| 3713 | goto end; | 3716 | goto end; |
| 3714 | avio_seek(s->pb, file_size - length, SEEK_SET); | 3717 | avio_seek(s->pb, file_size - length, SEEK_SET); |
| 3715 | if (klv_read_packet(&klv, s->pb) < 0 || | 3718 | if (klv_read_packet(mxf, &klv, s->pb) < 0 || |
| 3716 | !IS_KLV_KEY(klv.key, ff_mxf_random_index_pack_key)) | 3719 | !IS_KLV_KEY(klv.key, ff_mxf_random_index_pack_key)) |
| 3717 | goto end; | 3720 | goto end; |
| 3718 | if (klv.next_klv != file_size || klv.length <= 4 || (klv.length - 4) % 12) { | 3721 | if (klv.next_klv != file_size || klv.length <= 4 || (klv.length - 4) % 12) { |
| @@ -3759,7 +3762,7 @@ static int mxf_read_header(AVFormatContext *s) · 40 unmodified lines | |||
| 3759 | while (!avio_feof(s->pb)) { | 3762 | while (!avio_feof(s->pb)) { |
| 3760 | const MXFMetadataReadTableEntry *metadata; | 3763 | const MXFMetadataReadTableEntry *metadata; |
| 3761 | 3764 | ||
| 3762 | ret = klv_read_packet(&klv, s->pb); | 3765 | ret = klv_read_packet(mxf, &klv, s->pb); |
| 3763 | if (ret < 0 || IS_KLV_KEY(klv.key, ff_mxf_random_index_pack_key)) { | 3766 | if (ret < 0 || IS_KLV_KEY(klv.key, ff_mxf_random_index_pack_key)) { |
| 3764 | if (ret >= 0 && avio_size(s->pb) > klv.next_klv) | 3767 | if (ret >= 0 && avio_size(s->pb) > klv.next_klv) |
| 3765 | av_log(s, AV_LOG_WARNING, "data after the RandomIndexPack, assuming end of file\n"); | 3768 | av_log(s, AV_LOG_WARNING, "data after the RandomIndexPack, assuming end of file\n"); |
| @@ -4011,7 +4014,7 @@ static int mxf_read_packet(AVFormatContext *s, AVPacket *pkt) · 245 unmodified lines | |||
| 4011 | 4014 | ||
| 4012 | if (pos < mxf->current_klv_data.next_klv - mxf->current_klv_data.length || pos >= mxf->current_klv_data.next_klv) { | 4015 | if (pos < mxf->current_klv_data.next_klv - mxf->current_klv_data.length || pos >= mxf->current_klv_data.next_klv) { |
| 4013 | mxf->current_klv_data = (KLVPacket){{0}}; | 4016 | mxf->current_klv_data = (KLVPacket){{0}}; |
| 4014 | ret = klv_read_packet(&klv, s->pb); | 4017 | ret = klv_read_packet(mxf, &klv, s->pb); |
| 4015 | if (ret < 0) | 4018 | if (ret < 0) |
| 4016 | break; | 4019 | break; |
| 4017 | max_data_size = klv.length; | 4020 | max_data_size = klv.length; |