From b248dace929e97b10de17663caab32fbb1c42f0f Mon Sep 17 00:00:00 2001 From: James Almer Date: Sun, 23 Jun 2024 23:27:29 +0200 Subject: [PATCH] avformat/iamf_parse: keep substream count consistent Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct IAMFSubStream') Fixes: 69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/iamf_parse.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 9cec12d46f..a69d4a2f3a 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -594,7 +594,7 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) FFIOContext b; AVIOContext *pbc; uint8_t *buf; - unsigned audio_element_id, codec_config_id, num_parameters; + unsigned audio_element_id, nb_substreams, codec_config_id, num_parameters; int audio_element_type, ret; buf = av_malloc(len); @@ -649,14 +649,15 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) goto fail; } - audio_element->nb_substreams = ffio_read_leb(pbc); + nb_substreams = ffio_read_leb(pbc); audio_element->codec_config_id = codec_config_id; audio_element->audio_element_id = audio_element_id; - audio_element->substreams = av_calloc(audio_element->nb_substreams, sizeof(*audio_element->substreams)); + audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams)); if (!audio_element->substreams) { ret = AVERROR(ENOMEM); goto fail; } + audio_element->nb_substreams = nb_substreams; element = audio_element->element = av_iamf_audio_element_alloc(); if (!element) {