har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/iamf_parse: keep substream count consistent

Browse Source 
Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct IAMFSubStream')
Fixes: 69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b248dace929e97b10de17663caab32fbb1c42f0f)
This commit is contained in:
James Almer 2024-06-23 23:27:29 +02:00
parent 29d626ea85
commit 507348799c
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavformat/iamf_parse.c
View File

@ -594,7 +594,7 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
FFIOContext b; FFIOContext b;
AVIOContext *pbc; AVIOContext *pbc;
uint8_t *buf; uint8_t *buf;
unsigned audio_element_id, codec_config_id, num_parameters; unsigned audio_element_id, nb_substreams, codec_config_id, num_parameters;
int audio_element_type, ret; int audio_element_type, ret;
buf = av_malloc(len); buf = av_malloc(len);
@ -649,14 +649,15 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
goto fail; goto fail;
} }
audio_element->nb_substreams = ffio_read_leb(pbc); nb_substreams = ffio_read_leb(pbc);
audio_element->codec_config_id = codec_config_id; audio_element->codec_config_id = codec_config_id;
audio_element->audio_element_id = audio_element_id; audio_element->audio_element_id = audio_element_id;
audio_element->substreams = av_calloc(audio_element->nb_substreams, sizeof(*audio_element->substreams)); audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams));
if (!audio_element->substreams) { if (!audio_element->substreams) {
ret = AVERROR(ENOMEM); ret = AVERROR(ENOMEM);
goto fail; goto fail;
} }
audio_element->nb_substreams = nb_substreams;
element = audio_element->element = av_iamf_audio_element_alloc(); element = audio_element->element = av_iamf_audio_element_alloc();
if (!element) { if (!element) {