Fixes: Timeout
Fixes: 26909/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-6489496553783296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
break;
} else if (ea->audio_codec == AV_CODEC_ID_PCM_S16LE_PLANAR ||
ea->audio_codec == AV_CODEC_ID_MP3) {
+ if (chunk_size < 12)
+ return AVERROR_INVALIDDATA;
num_samples = avio_rl32(pb);
avio_skip(pb, 8);
chunk_size -= 12;
} else if (ea->audio_codec == AV_CODEC_ID_ADPCM_PSX) {
+ if (chunk_size < 8)
+ return AVERROR_INVALIDDATA;
avio_skip(pb, 8);
chunk_size -= 8;
}
case fVGT_TAG:
case MADm_TAG:
case MADe_TAG:
+ if (chunk_size > INT_MAX - 8)
+ return AVERROR_INVALIDDATA;
avio_seek(pb, -8, SEEK_CUR); // include chunk preamble
chunk_size += 8;
goto get_video_packet;