diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-07-05 22:09:26 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-09-08 21:31:50 +0200 |
| commit | 6a5d7fd8ad1cf420fc290998632973198e4f741b (patch) | |
| tree | be1cf4cbb75e0bed6070c4b9c6886341c31b0906 /libavcodec | |
| parent | 8da08ef1ffe7b2297a07d631038ddf4021c51ae1 (diff) | |
| download | ffmpeg-6a5d7fd8ad1cf420fc290998632973198e4f741b.tar.gz | |
avcodec/aacdec_template: Avoid some invalid values to be set by decode_audio_specific_config_gb()
Fixes: NULL pointer dereference
Fixes: decode_spectrum_and_dequant.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eaec4df63f98b6d2d60d2cf441de250c5f69359e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/aacdec_template.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c index 98f77a3ad7..3d7f3257db 100644 --- a/libavcodec/aacdec_template.c +++ b/libavcodec/aacdec_template.c @@ -1076,14 +1076,18 @@ static int decode_audio_specific_config_gb(AACContext *ac, { int i, ret; GetBitContext gbc = *gb; + MPEG4AudioConfig m4ac_bak = *m4ac; - if ((i = ff_mpeg4audio_get_config_gb(m4ac, &gbc, sync_extension, avctx)) < 0) + if ((i = ff_mpeg4audio_get_config_gb(m4ac, &gbc, sync_extension, avctx)) < 0) { + *m4ac = m4ac_bak; return AVERROR_INVALIDDATA; + } if (m4ac->sampling_index > 12) { av_log(avctx, AV_LOG_ERROR, "invalid sampling rate index %d\n", m4ac->sampling_index); + *m4ac = m4ac_bak; return AVERROR_INVALIDDATA; } if (m4ac->object_type == AOT_ER_AAC_LD && @@ -1091,6 +1095,7 @@ static int decode_audio_specific_config_gb(AACContext *ac, av_log(avctx, AV_LOG_ERROR, "invalid low delay sampling rate index %d\n", m4ac->sampling_index); + *m4ac = m4ac_bak; return AVERROR_INVALIDDATA; } |