diff --git a/fuzzers/common.h b/fuzzers/common.h index e7c29966a4..33a8424862 100644 --- a/fuzzers/common.h +++ b/fuzzers/common.h @@ -25,6 +25,8 @@ #include +#define MAX_FUZZ_SIZE (100 << 10) // 100 KiB + int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size); #define MPV_STRINGIFY_(X) #X diff --git a/fuzzers/fuzzer_json.c b/fuzzers/fuzzer_json.c index 1723a68cc2..b8e01373b1 100644 --- a/fuzzers/fuzzer_json.c +++ b/fuzzers/fuzzer_json.c @@ -22,6 +22,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + if (size > MAX_FUZZ_SIZE) + return 0; + void *tmp = talloc_new(NULL); char *s = talloc_array_ptrtype(tmp, s, size + 1); memcpy(s, data, size); diff --git a/fuzzers/fuzzer_load.c b/fuzzers/fuzzer_load.c index 39075fb90f..db3b192075 100644 --- a/fuzzers/fuzzer_load.c +++ b/fuzzers/fuzzer_load.c @@ -27,6 +27,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + if (size > MAX_FUZZ_SIZE) + return 0; + #ifdef MPV_LOAD_CONFIG_FILE // config file size limit, see m_config_parse_config_file() if (size > 1000000000) diff --git a/fuzzers/fuzzer_loadfile_direct.c b/fuzzers/fuzzer_loadfile_direct.c index be2fb1110d..f12134f22f 100644 --- a/fuzzers/fuzzer_loadfile_direct.c +++ b/fuzzers/fuzzer_loadfile_direct.c @@ -24,6 +24,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + if (size > MAX_FUZZ_SIZE) + return 0; + if (size <= 1 || data[size - 1] != '\0') return 0; diff --git a/fuzzers/fuzzer_set_property.c b/fuzzers/fuzzer_set_property.c index 04bda40623..f5c17c342a 100644 --- a/fuzzers/fuzzer_set_property.c +++ b/fuzzers/fuzzer_set_property.c @@ -19,6 +19,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + if (size > MAX_FUZZ_SIZE) + return 0; + size_t value_len; switch (MPV_FORMAT) {