har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tools/target_swr_fuzzer: Check av_samples_fill_arrays() for failure

Browse Source 
Fixes: use of uninitialized value
Fixes: 71242/clusterfuzz-testcase-minimized-ffmpeg_SWR_fuzzer-4905557943713792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-08-19 21:01:44 +02:00
parent b9c7f50c7d
commit 46e3bc2ebd
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
tools/target_swr_fuzzer.c
View File

@ -83,6 +83,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
int in_sample_nb; int in_sample_nb;
int out_sample_nb = size; int out_sample_nb = size;
int count; int count;
int ret;
if (size > 128) { if (size > 128) {
GetByteContext gbc; GetByteContext gbc;
@ -132,8 +133,12 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
if (!out_data) if (!out_data)
goto end; goto end;
av_samples_fill_arrays(ain , NULL, data, in_ch_count, in_sample_nb, in_sample_fmt, 1); ret = av_samples_fill_arrays(ain , NULL, data, in_ch_count, in_sample_nb, in_sample_fmt, 1);
av_samples_fill_arrays(aout, NULL, out_data, out_ch_count, out_sample_nb, out_sample_fmt, 1); if (ret < 0)
goto end;
ret = av_samples_fill_arrays(aout, NULL, out_data, out_ch_count, out_sample_nb, out_sample_fmt, 1);
if (ret < 0)
goto end;
count = swr_convert(swr, aout, out_sample_nb, (const uint8_t **)ain, in_sample_nb); count = swr_convert(swr, aout, out_sample_nb, (const uint8_t **)ain, in_sample_nb);