From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 26 Oct 2020 19:55:31 +0000 (+0100)
Subject: avformat/aiffdec: Check packet size
X-Git-Url: https://git.sesse.net/?a=commitdiff_plain;h=0ba71a72d3a617b255b71988a000d5093222f779;p=ffmpeg

avformat/aiffdec: Check packet size

Fixes: Fixes infinite loop
Fixes: 26575/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5727522236661760

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---

diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c
index c650e9074d5..15733478e14 100644
--- a/libavformat/aiffdec.c
+++ b/libavformat/aiffdec.c
@@ -406,6 +406,8 @@ static int aiff_read_packet(AVFormatContext *s,
         break;
     default:
         size = st->codecpar->block_align ? (MAX_SIZE / st->codecpar->block_align) * st->codecpar->block_align : MAX_SIZE;
+        if (!size)
+            return AVERROR_INVALIDDATA;
     }
     size = FFMIN(max_size, size);
     res = av_get_packet(s->pb, pkt, size);