diff options
| author | James Almer <jamrial@gmail.com> | 2024-09-17 15:39:57 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2024-09-17 15:41:45 -0300 |
| commit | 1c706cec46b8fe500c76f4cb5efbafccf47cfe20 (patch) | |
| tree | ca6c55f863f7ed5b6e127dd1f5dd1165e4d7cbce /libavformat | |
| parent | fec6a8df3127795f0796f73494df7f27fe354550 (diff) | |
| download | ffmpeg-1c706cec46b8fe500c76f4cb5efbafccf47cfe20.tar.gz | |
avformat/mov_chan: add extra checks to channel description count
Make sure it's not zero, and equal or bigger than number of channels
Fixes: Timeout / DOS
Fixes: 67143/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-4858720481771520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/mov_chan.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/libavformat/mov_chan.c b/libavformat/mov_chan.c index cc5b333129..4484a22a10 100644 --- a/libavformat/mov_chan.c +++ b/libavformat/mov_chan.c @@ -543,10 +543,22 @@ int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st, return 0; if (layout_tag == MOV_CH_LAYOUT_USE_DESCRIPTIONS) { - int nb_channels = ch_layout->nb_channels ? ch_layout->nb_channels : num_descr; + int nb_channels = ch_layout->nb_channels; + + if (!num_descr || num_descr < nb_channels) { + av_log(s, AV_LOG_ERROR, "got %d channel descriptions when at least %d were needed\n", + num_descr, nb_channels); + return AVERROR_INVALIDDATA; + } + if (num_descr > nb_channels) { - av_log(s, AV_LOG_WARNING, "got %d channel descriptions, capping to the number of channels %d\n", + int strict = s->strict_std_compliance >= FF_COMPLIANCE_STRICT; + av_log(s, strict ? AV_LOG_ERROR : AV_LOG_WARNING, + "got %d channel descriptions when number of channels is %d\n", num_descr, nb_channels); + if (strict) + return AVERROR_INVALIDDATA; + av_log(s, AV_LOG_WARNING, "capping channel descriptions to the number of channels\n"); num_descr = nb_channels; } |