This check matches the audio chunk check Fixes: Timeout Fixes: 62681/clusterfuzz-testcase-minimized-ffmpeg_dem_TMV_fuzzer-5299107876700160
Unified · Split
| @@ -103,6 +103,10 @@ static int tmv_read_header(AVFormatContext *s) · 102 unmodified lines | |||
| 103 | char_cols = avio_r8(pb); | 103 | char_cols = avio_r8(pb); |
| 104 | char_rows = avio_r8(pb); | 104 | char_rows = avio_r8(pb); |
| 105 | tmv->video_chunk_size = char_cols * char_rows * 2; | 105 | tmv->video_chunk_size = char_cols * char_rows * 2; |
| 106 | if (!tmv->video_chunk_size) { | ||
| 107 | av_log(s, AV_LOG_ERROR, "invalid video chunk size\n"); | ||
| 108 | return AVERROR_INVALIDDATA; | ||
| 109 | } | ||
| 106 | 110 | ||
| 107 | features = avio_r8(pb); | 111 | features = avio_r8(pb); |
| 108 | if (features & ~(TMV_PADDING | TMV_STEREO)) { | 112 | if (features & ~(TMV_PADDING | TMV_STEREO)) { |