avformat/jpegxl_anim_dec: Check that size fits within argument

Fixes: out of array access
Fixes: 61991/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5524679648215040
Fixes: 62181/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5504964305485824
Fixes: 62214/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-4782972823535616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/390/head
Michael Niedermayer 1 year ago
parent 00a837c70c
commit d2e8974699
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
  1. 2
      libavformat/jpegxl_anim_dec.c

@ -152,6 +152,8 @@ static int jpegxl_anim_read_packet(AVFormatContext *s, AVPacket *pkt)
size = avio_size(pb); size = avio_size(pb);
if (size < 0) if (size < 0)
return size; return size;
if (size > INT_MAX)
return AVERROR(EDOM);
if (size == 0) if (size == 0)
size = 4096; size = 4096;

Loading…
Cancel
Save