aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2019-06-16 20:56:20 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2019-06-29 19:36:02 +0200
commit3d1903acfee865935b73957e1b4df5ae090c93f9 (patch)
treec60d9896caaafe654b0e0692b53a269e0ccd96c2 /libavcodec
parent6872daee87b9b7a8adcb3bd3b1defea6f2153d2b (diff)
downloadffmpeg-3d1903acfee865935b73957e1b4df5ae090c93f9.tar.gz
avcodec/atrac9dec: Check that the reused block has succeeded initilization
Fixes: global-buffer-overflow Fixes: 15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit ac9af7e9a5befa8a554bacbcc59ab2f11203d85e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
-rw-r--r--libavcodec/atrac9dec.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/atrac9dec.c b/libavcodec/atrac9dec.c
index 805d46f3b8..11b683d136 100644
--- a/libavcodec/atrac9dec.c
+++ b/libavcodec/atrac9dec.c
@@ -71,6 +71,8 @@ typedef struct ATRAC9BlockData {
int cpe_base_channel;
int is_signs[30];
+ int reuseable;
+
} ATRAC9BlockData;
typedef struct ATRAC9Context {
@@ -668,6 +670,7 @@ static int atrac9_decode_block(ATRAC9Context *s, GetBitContext *gb,
if (!reuse_params) {
int stereo_band, ext_band;
const int min_band_count = s->samplerate_idx > 7 ? 1 : 3;
+ b->reuseable = 0;
b->band_count = get_bits(gb, 4) + min_band_count;
b->q_unit_cnt = at9_tab_band_q_unit_map[b->band_count];
@@ -699,6 +702,11 @@ static int atrac9_decode_block(ATRAC9Context *s, GetBitContext *gb,
}
b->band_ext_q_unit = at9_tab_band_q_unit_map[ext_band];
}
+ b->reuseable = 1;
+ }
+ if (!b->reuseable) {
+ av_log(s->avctx, AV_LOG_ERROR, "invalid block reused!\n");
+ return AVERROR_INVALIDDATA;
}
/* Calculate bit alloc gradient */