diff mbox series

[FFmpeg-devel,5/6] tools/target_swr_fuzzer: Check av_samples_fill_arrays() for failure

Message ID 20240820075057.1735944-5-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/6] avcodec/magicyuvenc: better slice height | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Aug. 20, 2024, 7:50 a.m. UTC 
Fixes: use of uninitialized value
Fixes: 71242/clusterfuzz-testcase-minimized-ffmpeg_SWR_fuzzer-4905557943713792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 tools/target_swr_fuzzer.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/tools/target_swr_fuzzer.c b/tools/target_swr_fuzzer.c
index f2d8ec49c05..b6cdb72a560 100644
--- a/tools/target_swr_fuzzer.c
+++ b/tools/target_swr_fuzzer.c
@@ -83,6 +83,7 @@  int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     int in_sample_nb;
     int out_sample_nb = size;
     int count;
+    int ret;
 
     if (size > 128) {
         GetByteContext gbc;
@@ -132,8 +133,12 @@  int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     if (!out_data)
         goto end;
 
-    av_samples_fill_arrays(ain , NULL,     data,  in_ch_count,  in_sample_nb,  in_sample_fmt, 1);
-    av_samples_fill_arrays(aout, NULL, out_data, out_ch_count, out_sample_nb, out_sample_fmt, 1);
+    ret = av_samples_fill_arrays(ain , NULL,     data,  in_ch_count,  in_sample_nb,  in_sample_fmt, 1);
+    if (ret < 0)
+        goto end;
+    ret = av_samples_fill_arrays(aout, NULL, out_data, out_ch_count, out_sample_nb, out_sample_fmt, 1);
+    if (ret < 0)
+        goto end;
 
     count = swr_convert(swr, aout, out_sample_nb, (const uint8_t **)ain, in_sample_nb);