Let's ignore the index table if the number of index entries does not match the index duration (or the special AVID index entry counts). Fixes: OOM Fixes: 50551/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6607795234930688
Showing the changes to libavformat (1 of 1 file). Show all
Unified · Split
| @@ -1937,6 +1937,14 @@ static int mxf_compute_ptses_fake_index(MXFContext *mxf, MXFIndexTable *index_ta · 1936 unmodified lines | ||
| 1937 | 1937 | return 0; |
| 1938 | 1938 | } |
| 1939 | 1939 | |
| 1940 | + if (s->nb_index_entries != s->index_duration && | |
| 1941 | + s->nb_index_entries != s->index_duration + 1 && /* Avid index */ | |
| 1942 | + s->nb_index_entries != s->index_duration * 2 + 1) { | |
| 1943 | + index_table->nb_ptses = 0; | |
| 1944 | + av_log(mxf->fc, AV_LOG_ERROR, "ignoring IndexSID %d, duration does not match nb_index_entries\n", s->index_sid); | |
| 1945 | + return 0; | |
| 1946 | + } | |
| 1947 | + | |
| 1940 | 1948 | index_table->nb_ptses += s->index_duration; |
| 1941 | 1949 | } |
| 1942 | 1950 | |