RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/aacsbr_template: Do not change bs_num_env before its checked 

Fixes: 1489/clusterfuzz-testcase-minimized-5075102901207040
Fixes: out of array access

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-05-12 04:12:15 +02:00
parent 48f7757749
commit 87b08ee6d2
1 changed files with 15 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
libavcodec/aacsbr_template.c
View File

@ -624,25 +624,26 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
int abs_bord_trail = 16; int abs_bord_trail = 16;
int num_rel_lead, num_rel_trail; int num_rel_lead, num_rel_trail;
unsigned bs_num_env_old = ch_data->bs_num_env; unsigned bs_num_env_old = ch_data->bs_num_env;
int bs_frame_class, bs_num_env;
ch_data->bs_freq_res[0] = ch_data->bs_freq_res[ch_data->bs_num_env]; ch_data->bs_freq_res[0] = ch_data->bs_freq_res[ch_data->bs_num_env];
ch_data->bs_amp_res = sbr->bs_amp_res_header; ch_data->bs_amp_res = sbr->bs_amp_res_header;
ch_data->t_env_num_env_old = ch_data->t_env[bs_num_env_old]; ch_data->t_env_num_env_old = ch_data->t_env[bs_num_env_old];
switch (ch_data->bs_frame_class = get_bits(gb, 2)) { switch (bs_frame_class = get_bits(gb, 2)) {
case FIXFIX: case FIXFIX:
ch_data->bs_num_env = 1 << get_bits(gb, 2); bs_num_env = 1 << get_bits(gb, 2);
if (bs_num_env > 4) {
av_log(ac->avctx, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
bs_num_env);
return -1;
}
ch_data->bs_num_env = bs_num_env;
num_rel_lead = ch_data->bs_num_env - 1; num_rel_lead = ch_data->bs_num_env - 1;
if (ch_data->bs_num_env == 1) if (ch_data->bs_num_env == 1)
ch_data->bs_amp_res = 0; ch_data->bs_amp_res = 0;
if (ch_data->bs_num_env > 4) {
av_log(ac->avctx, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
ch_data->bs_num_env);
ch_data->bs_num_env = 2;
return -1;
}
ch_data->t_env[0] = 0; ch_data->t_env[0] = 0;
ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail; ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
@ -690,15 +691,15 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
abs_bord_trail += get_bits(gb, 2); abs_bord_trail += get_bits(gb, 2);
num_rel_lead = get_bits(gb, 2); num_rel_lead = get_bits(gb, 2);
num_rel_trail = get_bits(gb, 2); num_rel_trail = get_bits(gb, 2);
ch_data->bs_num_env = num_rel_lead + num_rel_trail + 1; bs_num_env = num_rel_lead + num_rel_trail + 1;
if (ch_data->bs_num_env > 5) { if (bs_num_env > 5) {
av_log(ac->avctx, AV_LOG_ERROR, av_log(ac->avctx, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n", "Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n",
ch_data->bs_num_env); bs_num_env);
ch_data->bs_num_env = 2;
return -1; return -1;
} }
ch_data->bs_num_env = bs_num_env;
ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail; ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
@ -713,6 +714,7 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
get_bits1_vector(gb, ch_data->bs_freq_res + 1, ch_data->bs_num_env); get_bits1_vector(gb, ch_data->bs_freq_res + 1, ch_data->bs_num_env);
break; break;
} }
ch_data->bs_frame_class = bs_frame_class;
av_assert0(bs_pointer >= 0); av_assert0(bs_pointer >= 0);
if (bs_pointer > ch_data->bs_num_env + 1) { if (bs_pointer > ch_data->bs_num_env + 1) {