har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/aacdec_template: Avoid some invalid values to be set by decode_audio_specific_config_gb()

Browse Source 
Fixes: NULL pointer dereference
Fixes: decode_spectrum_and_dequant.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eaec4df63f98b6d2d60d2cf441de250c5f69359e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2021-07-05 22:09:26 +02:00
parent 4866d2a9ee
commit aa934f92e3
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/aacdec_template.c
View File

@ -974,14 +974,18 @@ static int decode_audio_specific_config_gb(AACContext *ac,
{ {
int i, ret; int i, ret;
GetBitContext gbc = *gb; GetBitContext gbc = *gb;
MPEG4AudioConfig m4ac_bak = *m4ac;
if ((i = ff_mpeg4audio_get_config_gb(m4ac, &gbc, sync_extension, avctx)) < 0) if ((i = ff_mpeg4audio_get_config_gb(m4ac, &gbc, sync_extension, avctx)) < 0) {
*m4ac = m4ac_bak;
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
}
if (m4ac->sampling_index > 12) { if (m4ac->sampling_index > 12) {
av_log(avctx, AV_LOG_ERROR, av_log(avctx, AV_LOG_ERROR,
"invalid sampling rate index %d\n", "invalid sampling rate index %d\n",
m4ac->sampling_index); m4ac->sampling_index);
*m4ac = m4ac_bak;
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
if (m4ac->object_type == AOT_ER_AAC_LD && if (m4ac->object_type == AOT_ER_AAC_LD &&
@ -989,6 +993,7 @@ static int decode_audio_specific_config_gb(AACContext *ac,
av_log(avctx, AV_LOG_ERROR, av_log(avctx, AV_LOG_ERROR,
"invalid low delay sampling rate index %d\n", "invalid low delay sampling rate index %d\n",
m4ac->sampling_index); m4ac->sampling_index);
*m4ac = m4ac_bak;
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }