RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/hcadec: do not set hfr_group_count to invalid values 

Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-6247136417087488
Fixes: out of array write

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-03-26 01:46:02 +01:00
parent 0a114d7318
commit addb85ea39
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/hcadec.c
View File

@ -212,6 +212,7 @@ static int init_hca(AVCodecContext *avctx, const uint8_t *extradata,
int8_t r[16] = { 0 };
unsigned b, chunk;
int version, ret;
unsigned hfr_group_count;
init_flush(avctx);
@ -336,11 +337,12 @@ static int init_hca(AVCodecContext *avctx, const uint8_t *extradata,
if (c->total_band_count < c->base_band_count)
return AVERROR_INVALIDDATA;
c->hfr_group_count = ceil2(c->total_band_count - (c->base_band_count + c->stereo_band_count),
hfr_group_count = ceil2(c->total_band_count - (c->base_band_count + c->stereo_band_count),
c->bands_per_hfr_group);
if (c->base_band_count + c->stereo_band_count + (unsigned long)c->hfr_group_count > 128ULL)
if (c->base_band_count + c->stereo_band_count + (uint64_t)hfr_group_count > 128ULL)
return AVERROR_INVALIDDATA;
c->hfr_group_count = hfr_group_count;
for (int i = 0; i < avctx->ch_layout.nb_channels; i++) {
c->ch[i].chan_type = r[i];