diff options
| author | James Almer <jamrial@gmail.com> | 2025-08-16 14:16:38 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2025-08-16 21:59:18 -0300 |
| commit | a28e01a6c16430da689340d0af6eec094020b719 (patch) | |
| tree | 6c5527e535d93dc2bcb673efdac860ac356bce11 | |
| parent | 7df92712723dee0ace3596684a90282c0e12a8ef (diff) | |
| download | ffmpeg-a28e01a6c16430da689340d0af6eec094020b719.tar.gz | |
avformat/mov: don't use an allocated array for sample_size with HEIF images
The array is only ever needed for streams where each sample entry may have a
different value. Given that for non animated HEIF there's a single value that
applies to the image, use the field defined for that.
Fixes: NULL pointer dereference
Fixes: 437528618/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6537287645331456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
| -rw-r--r-- | libavformat/mov.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 86037c6712..b29c41a6b6 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5456,10 +5456,6 @@ static int heif_add_stream(MOVContext *c, HEIFItem *item) if (!sc->chunk_offsets) goto fail; sc->chunk_count = 1; - sc->sample_sizes = av_malloc_array(1, sizeof(*sc->sample_sizes)); - if (!sc->sample_sizes) - goto fail; - sc->sample_count = 1; sc->stts_data = av_malloc_array(1, sizeof(*sc->stts_data)); if (!sc->stts_data) goto fail; @@ -10471,11 +10467,13 @@ static int mov_parse_heif_items(AVFormatContext *s) st->codecpar->width = item->width; st->codecpar->height = item->height; + sc->sample_size = sc->stsz_sample_size = item->extent_length; + sc->sample_count = 1; + err = sanity_checks(s, sc, item->item_id); - if (err || !sc->sample_count) + if (err) return AVERROR_INVALIDDATA; - sc->sample_sizes[0] = item->extent_length; sc->chunk_offsets[0] = item->extent_offset + offset; if (item->item_id == mov->primary_item_id) |