diff options
| author | James Almer <jamrial@gmail.com> | 2024-06-23 23:27:29 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-07-16 18:43:14 +0200 |
| commit | b248dace929e97b10de17663caab32fbb1c42f0f (patch) | |
| tree | 31f928fbaab2845720d9d6070d2e375458786d15 | |
| parent | 7147c3c911f4ebf5bd1c21444423d8f78c6541ea (diff) | |
| download | ffmpeg-b248dace929e97b10de17663caab32fbb1c42f0f.tar.gz | |
avformat/iamf_parse: keep substream count consistent
Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct IAMFSubStream')
Fixes: 69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/iamf_parse.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 9cec12d46f..a69d4a2f3a 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -594,7 +594,7 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) FFIOContext b; AVIOContext *pbc; uint8_t *buf; - unsigned audio_element_id, codec_config_id, num_parameters; + unsigned audio_element_id, nb_substreams, codec_config_id, num_parameters; int audio_element_type, ret; buf = av_malloc(len); @@ -649,14 +649,15 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) goto fail; } - audio_element->nb_substreams = ffio_read_leb(pbc); + nb_substreams = ffio_read_leb(pbc); audio_element->codec_config_id = codec_config_id; audio_element->audio_element_id = audio_element_id; - audio_element->substreams = av_calloc(audio_element->nb_substreams, sizeof(*audio_element->substreams)); + audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams)); if (!audio_element->substreams) { ret = AVERROR(ENOMEM); goto fail; } + audio_element->nb_substreams = nb_substreams; element = audio_element->element = av_iamf_audio_element_alloc(); if (!element) { |