videolan
/
ffmpeg
mirror of https://git.videolan.org/git/ffmpeg.git
1
Fork 0
Code Releases Activity

avformat/imf_cpl: xmlNodeListGetString() can return NULL 

Fixes: NULL pointer dereference
Fixes: 60166/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5998301577871360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Pierre-Anthony Lemieux <pal@sandflow.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-07-23 20:03:01 +02:00
parent c5c719f030
commit 509ce40f18
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavformat/imf_cpl.c
View File

@ -75,6 +75,8 @@ int ff_imf_xml_read_uuid(xmlNodePtr element, AVUUID uuid)
int ret = 0;
xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
if (!element_text)
return AVERROR_INVALIDDATA;
ret = av_uuid_urn_parse(element_text, uuid);
if (ret)
ret = AVERROR_INVALIDDATA;
@ -88,7 +90,7 @@ int ff_imf_xml_read_rational(xmlNodePtr element, AVRational *rational)
int ret = 0;
xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
if (sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2)
if (element_text == NULL || sscanf(element_text, "%i %i", &rational->num, &rational->den) != 2)
ret = AVERROR_INVALIDDATA;
xmlFree(element_text);
@ -100,7 +102,7 @@ int ff_imf_xml_read_uint32(xmlNodePtr element, uint32_t *number)
int ret = 0;
xmlChar *element_text = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
if (sscanf(element_text, "%" PRIu32, number) != 1)
if (element_text == NULL || sscanf(element_text, "%" PRIu32, number) != 1)
ret = AVERROR_INVALIDDATA;
xmlFree(element_text);
@ -245,6 +247,8 @@ static int fill_timecode(xmlNodePtr cpl_element, FFIMFCPL *cpl)
return AVERROR_INVALIDDATA;
tc_str = xmlNodeListGetString(element->doc, element->xmlChildrenNode, 1);
if (!tc_str)
return AVERROR_INVALIDDATA;
ret = parse_cpl_tc_type(tc_str, comps);
xmlFree(tc_str);
if (ret)