RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/iamf_parse: consider nb_substreams when accessing substreams array 

Fixes: out of array access
Fixes: 68584/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6256656668229632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-06-17 01:08:25 +02:00
parent 97ecfb5a19
commit c69e6cccd7
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libavformat/iamf_parse.c
View File

@ -355,6 +355,9 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb,
substream_count = avio_r8(pb); substream_count = avio_r8(pb);
coupled_substream_count = avio_r8(pb); coupled_substream_count = avio_r8(pb);
if (substream_count + k > audio_element->nb_substreams)
return AVERROR_INVALIDDATA;
audio_element->layers[i].substream_count = substream_count; audio_element->layers[i].substream_count = substream_count;
audio_element->layers[i].coupled_substream_count = coupled_substream_count; audio_element->layers[i].coupled_substream_count = coupled_substream_count;
if (output_gain_is_present_flag) { if (output_gain_is_present_flag) {