Let's ignore the index table if the number of index entries does not match the index duration (or the special AVID index entry counts). Fixes: OOM Fixes: 50551/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6607795234930688
Showing the changes to libavformat (1 of 1 file). Show all
Unified · Split
| @@ -1937,6 +1937,14 @@ static int mxf_compute_ptses_fake_index(MXFContext *mxf, MXFIndexTable *index_ta · 1936 unmodified lines | |||
| 1937 | return 0; | 1937 | return 0; |
| 1938 | } | 1938 | } |
| 1939 | 1939 | ||
| 1940 | if (s->nb_index_entries != s->index_duration && | ||
| 1941 | s->nb_index_entries != s->index_duration + 1 && /* Avid index */ | ||
| 1942 | s->nb_index_entries != s->index_duration * 2 + 1) { | ||
| 1943 | index_table->nb_ptses = 0; | ||
| 1944 | av_log(mxf->fc, AV_LOG_ERROR, "ignoring IndexSID %d, duration does not match nb_index_entries\n", s->index_sid); | ||
| 1945 | return 0; | ||
| 1946 | } | ||
| 1947 | |||
| 1940 | index_table->nb_ptses += s->index_duration; | 1948 | index_table->nb_ptses += s->index_duration; |
| 1941 | } | 1949 | } |
| 1942 | 1950 | ||