projects / ffmpeg.git / commitdiff
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: b7f3a66)
avformat/matroskadec: bound TRACKENTRY parsing by max_streams
authorMichael Niedermayer <michael@niedermayer.cc>
Fri, 29 May 2026 15:56:22 +0000 (17:56 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Sun, 14 Jun 2026 02:41:02 +0000 (04:41 +0200)
After the fix the reproducer finishes in 43 ms instead of OOM-ing at the
2 GB limit. Legitimate .mkv/.webm fate samples still parse cleanly.

Fixes: 471604245/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6662979358883840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c7e0bac050a672a220ed8ee6dbdc25abfb3336a8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/matroskadec.c patch | blob | history

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 3ac81aa09576f9a02d92553f571114665d977a89..b9c903218211071ad3b582e55310d0fdca41f8ce 100644 (file)
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1338,6 +1338,13 @@ static int ebml_parse(MatroskaDemuxContext *matroska,
 
             if ((unsigned)list->nb_elem + 1 >= UINT_MAX / syntax->list_elem_size)
                 return AVERROR(ENOMEM);
+            if (syntax->id == MATROSKA_ID_TRACKENTRY &&
+                list->nb_elem >= matroska->ctx->max_streams) {
+                av_log(matroska->ctx, AV_LOG_ERROR,
+                       "Number of tracks exceeds max_streams (%d)\n",
+                       matroska->ctx->max_streams);
+                return AVERROR(EINVAL);
+            }
             newelem = av_fast_realloc(list->elem,
                                       &list->alloc_elem_size,
                                       (list->nb_elem + 1) * syntax->list_elem_size);
FFmpeg git repo