diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-09-27 20:23:10 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-10-17 21:34:53 +0200 |
| commit | 25e421ddc32cee2050fe6b97271be7e016ea975f (patch) | |
| tree | 24a29b1304d201f81dd1ac86c1fb024dd019998a | |
| parent | 556141047a98713d465a81ef8b1e48ad09751932 (diff) | |
| download | ffmpeg-25e421ddc32cee2050fe6b97271be7e016ea975f.tar.gz | |
avcodec/cook: Check subpacket index against max
Fixes: off by 1 error
Fixes: index 5 out of bounds for type 'COOKSubpacket [5]'
Fixes: 25772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5762459498184704.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5a2a7604da5f7a2fc498d1d5c90bd892edac9ce8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/cook.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libavcodec/cook.c b/libavcodec/cook.c index c898fdad0e..211c9093bb 100644 --- a/libavcodec/cook.c +++ b/libavcodec/cook.c @@ -1077,6 +1077,10 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) ff_audiodsp_init(&q->adsp); while (edata_ptr < edata_ptr_end) { + if (s >= FFMIN(MAX_SUBPACKETS, avctx->block_align)) { + avpriv_request_sample(avctx, "subpackets > %d", FFMIN(MAX_SUBPACKETS, avctx->block_align)); + return AVERROR_PATCHWELCOME; + } /* 8 for mono, 16 for stereo, ? for multichannel Swap to right endianness so we don't need to care later on. */ if (extradata_size >= 8) { @@ -1216,10 +1220,6 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) q->num_subpackets++; s++; - if (s > FFMIN(MAX_SUBPACKETS, avctx->block_align)) { - avpriv_request_sample(avctx, "subpackets > %d", FFMIN(MAX_SUBPACKETS, avctx->block_align)); - return AVERROR_PATCHWELCOME; - } } /* Generate tables */ init_pow2table(); |