diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-04-10 02:46:25 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-14 12:20:16 +0200 |
| commit | 332a9cbbf7dff12566b3592fc5f756a49812a724 (patch) | |
| tree | 3431c2b3eb9579d65703420281831957f07d2693 | |
| parent | 36dd76ef14597b98b9f2b75436d68be3b8d7b96c (diff) | |
| download | ffmpeg-332a9cbbf7dff12566b3592fc5f756a49812a724.tar.gz | |
avcodec/aacdec_template: Do not decode 2nd PCE if it will lead to failure
Fixes: out of array read
Fixes: 1072/clusterfuzz-testcase-6456688074817536
Fixes: 1398/clusterfuzz-testcase-minimized-4576913622302720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5e0dbf530d447f36099aed575b34e9258c5d75a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/aacdec_template.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c index 883ed527f7..f730ad935e 100644 --- a/libavcodec/aacdec_template.c +++ b/libavcodec/aacdec_template.c @@ -406,11 +406,15 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags) /** * Save current output configuration if and only if it has been locked. */ -static void push_output_configuration(AACContext *ac) { +static int push_output_configuration(AACContext *ac) { + int pushed = 0; + if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) { ac->oc[0] = ac->oc[1]; + pushed = 1; } ac->oc[1].status = OC_NONE; + return pushed; } /** @@ -3002,7 +3006,13 @@ static int aac_decode_frame_int(AVCodecContext *avctx, void *data, case TYPE_PCE: { uint8_t layout_map[MAX_ELEM_ID*4][3]; int tags; - push_output_configuration(ac); + + int pushed = push_output_configuration(ac); + if (pce_found && !pushed) { + err = AVERROR_INVALIDDATA; + goto fail; + } + tags = decode_pce(avctx, &ac->oc[1].m4ac, layout_map, gb); if (tags < 0) { err = tags; |