| Message ID | 20240616230831.912377-3-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,1/9] avcodec/targaenc: Allocate space for the palette | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
On 6/16/2024 8:08 PM, Michael Niedermayer wrote: > Fixes: out of array access > Fixes: 68584/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6256656668229632 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/iamf_parse.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c > index 312090b247c..5c2ff6862a7 100644 > --- a/libavformat/iamf_parse.c > +++ b/libavformat/iamf_parse.c > @@ -355,6 +355,9 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb, > substream_count = avio_r8(pb); > coupled_substream_count = avio_r8(pb); > > + if (substream_count + k > audio_element->nb_substreams) > + return AVERROR_INVALIDDATA; > + > audio_element->layers[i].substream_count = substream_count; > audio_element->layers[i].coupled_substream_count = coupled_substream_count; > if (output_gain_is_present_flag) { LGTM, and ditto, change the commit message.
On Mon, Jun 17, 2024 at 09:35:06PM -0300, James Almer wrote: > On 6/16/2024 8:08 PM, Michael Niedermayer wrote: > > Fixes: out of array access > > Fixes: 68584/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6256656668229632 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/iamf_parse.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c > > index 312090b247c..5c2ff6862a7 100644 > > --- a/libavformat/iamf_parse.c > > +++ b/libavformat/iamf_parse.c > > @@ -355,6 +355,9 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb, > > substream_count = avio_r8(pb); > > coupled_substream_count = avio_r8(pb); > > + if (substream_count + k > audio_element->nb_substreams) > > + return AVERROR_INVALIDDATA; > > + > > audio_element->layers[i].substream_count = substream_count; > > audio_element->layers[i].coupled_substream_count = coupled_substream_count; > > if (output_gain_is_present_flag) { > > LGTM, will apply > and ditto, change the commit message. you lack humor ;( thx [...]
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 312090b247c..5c2ff6862a7 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -355,6 +355,9 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb, substream_count = avio_r8(pb); coupled_substream_count = avio_r8(pb); + if (substream_count + k > audio_element->nb_substreams) + return AVERROR_INVALIDDATA; + audio_element->layers[i].substream_count = substream_count; audio_element->layers[i].coupled_substream_count = coupled_substream_count; if (output_gain_is_present_flag) {
Fixes: out of array access Fixes: 68584/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6256656668229632 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/iamf_parse.c | 3 +++ 1 file changed, 3 insertions(+)