diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-04-10 02:46:25 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-07 19:32:33 +0200 |
| commit | a5e0dbf530d447f36099aed575b34e9258c5d75a (patch) | |
| tree | 98b2ce378ecd3355021eedf4cb19be2cc0c415b7 | |
| parent | a38e9797cb4123d13ba871d166a737786ba04a9b (diff) | |
| download | ffmpeg-a5e0dbf530d447f36099aed575b34e9258c5d75a.tar.gz | |
avcodec/aacdec_template: Do not decode 2nd PCE if it will lead to failure
Fixes: out of array read
Fixes: 1072/clusterfuzz-testcase-6456688074817536
Fixes: 1398/clusterfuzz-testcase-minimized-4576913622302720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/aacdec_template.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c index 98a3240597..b20855b99d 100644 --- a/libavcodec/aacdec_template.c +++ b/libavcodec/aacdec_template.c @@ -406,11 +406,15 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags) /** * Save current output configuration if and only if it has been locked. */ -static void push_output_configuration(AACContext *ac) { +static int push_output_configuration(AACContext *ac) { + int pushed = 0; + if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) { ac->oc[0] = ac->oc[1]; + pushed = 1; } ac->oc[1].status = OC_NONE; + return pushed; } /** @@ -3026,7 +3030,13 @@ static int aac_decode_frame_int(AVCodecContext *avctx, void *data, case TYPE_PCE: { uint8_t layout_map[MAX_ELEM_ID*4][3]; int tags; - push_output_configuration(ac); + + int pushed = push_output_configuration(ac); + if (pce_found && !pushed) { + err = AVERROR_INVALIDDATA; + goto fail; + } + tags = decode_pce(avctx, &ac->oc[1].m4ac, layout_map, gb, payload_alignment); if (tags < 0) { |