| Message ID | 20240623230137.1749178-5-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,1/5] avcodec/aac/aacdec_usac: Test ac in usac | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Mon, Jun 24, 2024 at 01:01:37AM +0200, Michael Niedermayer wrote: > Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct IAMFSubStream') > Fixes: 69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/iamf.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) will apply [...]
On 6/23/2024 8:01 PM, Michael Niedermayer wrote: > Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct IAMFSubStream') > Fixes: 69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/iamf.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/libavformat/iamf.c b/libavformat/iamf.c > index 5de70dc0828..364cb60e021 100644 > --- a/libavformat/iamf.c > +++ b/libavformat/iamf.c > @@ -74,8 +74,10 @@ void ff_iamf_free_audio_element(IAMFAudioElement **paudio_element) > if (!audio_element) > return; > > - for (int i = 0; i < audio_element->nb_substreams; i++) > - avcodec_parameters_free(&audio_element->substreams[i].codecpar); > + if (audio_element->nb_substreams) > + for (int i = 0; i < audio_element->nb_substreams; i++) { > + avcodec_parameters_free(&audio_element->substreams[i].codecpar); > + } > av_free(audio_element->substreams); > av_free(audio_element->layers); > av_iamf_audio_element_free(&audio_element->element); Sorry, i missed this. nb_substreams shouldn't be anything but 0 here if nb_substreams is NULL, so the following is IMO better: > diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c > index 9cec12d46f..a69d4a2f3a 100644 > --- a/libavformat/iamf_parse.c > +++ b/libavformat/iamf_parse.c > @@ -594,7 +594,7 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) > FFIOContext b; > AVIOContext *pbc; > uint8_t *buf; > - unsigned audio_element_id, codec_config_id, num_parameters; > + unsigned audio_element_id, nb_substreams, codec_config_id, num_parameters; > int audio_element_type, ret; > > buf = av_malloc(len); > @@ -649,14 +649,15 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) > goto fail; > } > > - audio_element->nb_substreams = ffio_read_leb(pbc); > + nb_substreams = ffio_read_leb(pbc); > audio_element->codec_config_id = codec_config_id; > audio_element->audio_element_id = audio_element_id; > - audio_element->substreams = av_calloc(audio_element->nb_substreams, sizeof(*audio_element->substreams)); > + audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams)); > if (!audio_element->substreams) { > ret = AVERROR(ENOMEM); > goto fail; > } > + audio_element->nb_substreams = nb_substreams; > > element = audio_element->element = av_iamf_audio_element_alloc(); > if (!element) {
diff --git a/libavformat/iamf.c b/libavformat/iamf.c index 5de70dc0828..364cb60e021 100644 --- a/libavformat/iamf.c +++ b/libavformat/iamf.c @@ -74,8 +74,10 @@ void ff_iamf_free_audio_element(IAMFAudioElement **paudio_element) if (!audio_element) return; - for (int i = 0; i < audio_element->nb_substreams; i++) - avcodec_parameters_free(&audio_element->substreams[i].codecpar); + if (audio_element->substreams) + for (int i = 0; i < audio_element->nb_substreams; i++) { + avcodec_parameters_free(&audio_element->substreams[i].codecpar); + } av_free(audio_element->substreams); av_free(audio_element->layers); av_iamf_audio_element_free(&audio_element->element);
Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct IAMFSubStream') Fixes: 69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/iamf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)