From 8ab27413589fc85951e1a2b634b700081fab86ca Mon Sep 17 00:00:00 2001 From: wanghao-free Date: Fri, 3 Feb 2023 00:44:07 -0800 Subject: [PATCH] fix CVE-2022-3341 Signed-off-by: wanghao-free --- ffmpeg-y/libavformat/nutdec.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/ffmpeg-y/libavformat/nutdec.c b/ffmpeg-y/libavformat/nutdec.c index 3779dce2a8..66e38e32b0 100755 --- a/ffmpeg-y/libavformat/nutdec.c +++ b/ffmpeg-y/libavformat/nutdec.c @@ -346,8 +346,13 @@ static int decode_main_header(NUTContext *nut) ret = AVERROR(ENOMEM); goto fail; } - for (i = 0; i < stream_count; i++) - avformat_new_stream(s, NULL); + + for (i = 0; i < stream_count; i++) { + if (!avformat_new_stream(s, NULL)) { + ret = AVERROR(ENOMEM); + goto fail; + } + } return 0; fail: @@ -795,19 +800,23 @@ static int nut_read_header(AVFormatContext *s) NUTContext *nut = s->priv_data; AVIOContext *bc = s->pb; int64_t pos; - int initialized_stream_count; + int initialized_stream_count, ret; nut->avf = s; /* main header */ pos = 0; + ret = 0; do { + if (ret == AVERROR(ENOMEM)) + return ret; + pos = find_startcode(bc, MAIN_STARTCODE, pos) + 1; if (pos < 0 + 1) { av_log(s, AV_LOG_ERROR, "No main startcode found.\n"); goto fail; } - } while (decode_main_header(nut) < 0); + } while ((ret = decode_main_header(nut)) < 0); /* stream headers */ pos = 0; -- Gitee