RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/iamf_parse: keep substream count consistent 

Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct IAMFSubStream')
Fixes: 69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
James Almer 2024-06-23 23:27:29 +02:00 committed by Michael Niedermayer
parent 7147c3c911
commit b248dace92
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavformat/iamf_parse.c
View File

@ -594,7 +594,7 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
FFIOContext b;
AVIOContext *pbc;
uint8_t *buf;
unsigned audio_element_id, codec_config_id, num_parameters;
unsigned audio_element_id, nb_substreams, codec_config_id, num_parameters;
int audio_element_type, ret;
buf = av_malloc(len);
@ -649,14 +649,15 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
goto fail;
}
audio_element->nb_substreams = ffio_read_leb(pbc);
nb_substreams = ffio_read_leb(pbc);
audio_element->codec_config_id = codec_config_id;
audio_element->audio_element_id = audio_element_id;
audio_element->substreams = av_calloc(audio_element->nb_substreams, sizeof(*audio_element->substreams));
audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams));
if (!audio_element->substreams) {
ret = AVERROR(ENOMEM);
goto fail;
}
audio_element->nb_substreams = nb_substreams;
element = audio_element->element = av_iamf_audio_element_alloc();
if (!element) {