diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-06-27 15:56:18 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-07-16 19:02:12 +0200 |
| commit | 1361e4abb81f28ac73cc41ae6bf94c045bbb7eee (patch) | |
| tree | eddd27c0307a95634b374439c72d59982e5d717e | |
| parent | 5fd1dce39a70340b9fd508154e48985902602e25 (diff) | |
| download | ffmpeg-1361e4abb81f28ac73cc41ae6bf94c045bbb7eee.tar.gz | |
avcodec/ac3dec: Check channel_map index
Fixes: out of array read
Fixes: 8924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EAC3_fuzzer-5851861780267008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 00f98d23b1462afb97116b947334db3754516207)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/ac3dec.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index dfa025cbcc..ea7e052f8b 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -1690,6 +1690,7 @@ dependent_frame: if (s->frame_type == EAC3_FRAME_TYPE_DEPENDENT) { uint64_t ich_layout = avpriv_ac3_channel_layout_tab[s->prev_output_mode & ~AC3_OUTPUT_LFEON]; + int channel_map_size = ff_ac3_channels_tab[s->output_mode & ~AC3_OUTPUT_LFEON] + s->lfe_on; uint64_t channel_layout; int extend = 0; @@ -1718,6 +1719,9 @@ dependent_frame: custom_channel_map_locations[ch][1]); if (index < 0) return AVERROR_INVALIDDATA; + if (extend >= channel_map_size) + return AVERROR_INVALIDDATA; + extended_channel_map[index] = offset + channel_map[extend++]; } else { int i; @@ -1728,6 +1732,9 @@ dependent_frame: 1LL << i); if (index < 0) return AVERROR_INVALIDDATA; + if (extend >= channel_map_size) + return AVERROR_INVALIDDATA; + extended_channel_map[index] = offset + channel_map[extend++]; } } |