diff mbox series

[FFmpeg-devel,1/2] avcodec/wmalosslessdec: Check channels after setting them

Message ID 20220401104608.10193-1-michael@niedermayer.cc
State Accepted
Commit 5d6cdb015e99c83e016b9398c6e0f236067f8248
Headers show
Series [FFmpeg-devel,1/2] avcodec/wmalosslessdec: Check channels after setting them | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer April 1, 2022, 10:46 a.m. UTC 
Fixes: 46194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-580292873827123
Fixes: stack-buffer-overflow on address 0x7ffc0ce69b30 at pc 0x00000062fb03 bp 0x7ffc0ce69af0 sp 0x7ffc0ce69ae8
Fixes: 46205/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5354894996930560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/wmalosslessdec.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)
diff mbox series

Patch

diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c
index d4f3462804..fd16f3f9bc 100644
--- a/libavcodec/wmalosslessdec.c
+++ b/libavcodec/wmalosslessdec.c
@@ -191,13 +191,6 @@  static av_cold int decode_init(AVCodecContext *avctx)
         return AVERROR(EINVAL);
     }
 
-    av_assert0(avctx->ch_layout.nb_channels >= 0);
-    if (avctx->ch_layout.nb_channels > WMALL_MAX_CHANNELS) {
-        avpriv_request_sample(avctx,
-                              "More than " AV_STRINGIFY(WMALL_MAX_CHANNELS) " channels");
-        return AVERROR_PATCHWELCOME;
-    }
-
     if (avctx->extradata_size >= 18) {
         s->decode_flags    = AV_RL16(edata_ptr + 14);
         channel_mask       = AV_RL32(edata_ptr +  2);
@@ -226,6 +219,12 @@  static av_cold int decode_init(AVCodecContext *avctx)
         av_channel_layout_uninit(&avctx->ch_layout);
         av_channel_layout_from_mask(&avctx->ch_layout, channel_mask);
     }
+    av_assert0(avctx->ch_layout.nb_channels >= 0);
+    if (avctx->ch_layout.nb_channels > WMALL_MAX_CHANNELS) {
+        avpriv_request_sample(avctx,
+                            "More than " AV_STRINGIFY(WMALL_MAX_CHANNELS) " channels");
+        return AVERROR_PATCHWELCOME;
+    }
 
     s->num_channels = avctx->ch_layout.nb_channels;