RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/hcadec: do not set hfr_group_count to invalid values 

Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-6247136417087488
Fixes: out of array write

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit addb85ea39)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-03-26 01:46:02 +01:00
parent 2e396e6ca8
commit 4ddc5bc4bd
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/hcadec.c
View File

@ -109,6 +109,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
float scale = 1.f / 8.f;
unsigned b, chunk;
int version, ret;
unsigned hfr_group_count;
avctx->sample_fmt = AV_SAMPLE_FMT_FLTP;
c->crc_table = av_crc_get_table(AV_CRC_16_ANSI);
@ -232,11 +233,12 @@ static av_cold int decode_init(AVCodecContext *avctx)
if (c->total_band_count < c->base_band_count)
return AVERROR_INVALIDDATA;
c->hfr_group_count = ceil2(c->total_band_count - (c->base_band_count + c->stereo_band_count),
hfr_group_count = ceil2(c->total_band_count - (c->base_band_count + c->stereo_band_count),
c->bands_per_hfr_group);
if (c->base_band_count + c->stereo_band_count + (unsigned long)c->hfr_group_count > 128ULL)
if (c->base_band_count + c->stereo_band_count + (uint64_t)hfr_group_count > 128ULL)
return AVERROR_INVALIDDATA;
c->hfr_group_count = hfr_group_count;
for (int i = 0; i < avctx->channels; i++) {
c->ch[i].chan_type = r[i];