Commit 8edfd059 authored by Michael Niedermayer's avatar Michael Niedermayer

avformat/oggdec: Do not hardcode arbitrary and sometimes unavailable size

Fixes: regression since e983197c
Fixes: out of array read
Fixes: 22185/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5662069073641472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: 's avatarLynne <dev@lynne.ee>
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 108ee4b4
...@@ -206,7 +206,7 @@ static const struct ogg_codec *ogg_find_codec(uint8_t *buf, int size) ...@@ -206,7 +206,7 @@ static const struct ogg_codec *ogg_find_codec(uint8_t *buf, int size)
* situation where a new audio stream spawn (identified with a new serial) and * situation where a new audio stream spawn (identified with a new serial) and
* must replace the previous one (track switch). * must replace the previous one (track switch).
*/ */
static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic, static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic, int page_size,
int probing) int probing)
{ {
struct ogg *ogg = s->priv_data; struct ogg *ogg = s->priv_data;
...@@ -220,7 +220,7 @@ static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic, ...@@ -220,7 +220,7 @@ static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic,
} }
/* Check for codecs */ /* Check for codecs */
codec = ogg_find_codec(magic, 8); codec = ogg_find_codec(magic, page_size);
if (!codec && !probing) { if (!codec && !probing) {
av_log(s, AV_LOG_ERROR, "Cannot identify new stream\n"); av_log(s, AV_LOG_ERROR, "Cannot identify new stream\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
...@@ -430,7 +430,7 @@ static int ogg_read_page(AVFormatContext *s, int *sid, int probing) ...@@ -430,7 +430,7 @@ static int ogg_read_page(AVFormatContext *s, int *sid, int probing)
/* CRC is correct so we can be 99% sure there's an actual change here */ /* CRC is correct so we can be 99% sure there's an actual change here */
if (idx < 0) { if (idx < 0) {
if (data_packets_seen(ogg)) if (data_packets_seen(ogg))
idx = ogg_replace_stream(s, serial, readout_buf, probing); idx = ogg_replace_stream(s, serial, readout_buf, size, probing);
else else
idx = ogg_new_stream(s, serial); idx = ogg_new_stream(s, serial);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment