ffmpeg | branch: release/7.0 | James Almer <jamr...@gmail.com> | Tue Sep 17 15:39:57 2024 -0300| [3e6cec12865d53ebdb5e5bf344ebfc4f4b9ccb85] | committer: James Almer
avformat/mov_chan: add extra checks to channel description count Make sure it's not zero, and equal or bigger than number of channels Fixes: Timeout / DOS Fixes: 67143/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-4858720481771520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: James Almer <jamr...@gmail.com> (cherry picked from commit 1c706cec46b8fe500c76f4cb5efbafccf47cfe20) > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3e6cec12865d53ebdb5e5bf344ebfc4f4b9ccb85 --- libavformat/mov_chan.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/libavformat/mov_chan.c b/libavformat/mov_chan.c index 287059d65b..3c7274b737 100644 --- a/libavformat/mov_chan.c +++ b/libavformat/mov_chan.c @@ -462,10 +462,22 @@ int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st, return 0; if (layout_tag == MOV_CH_LAYOUT_USE_DESCRIPTIONS) { - int nb_channels = ch_layout->nb_channels ? ch_layout->nb_channels : num_descr; + int nb_channels = ch_layout->nb_channels; + + if (!num_descr || num_descr < nb_channels) { + av_log(s, AV_LOG_ERROR, "got %d channel descriptions when at least %d were needed\n", + num_descr, nb_channels); + return AVERROR_INVALIDDATA; + } + if (num_descr > nb_channels) { - av_log(s, AV_LOG_WARNING, "got %d channel descriptions, capping to the number of channels %d\n", + int strict = s->strict_std_compliance >= FF_COMPLIANCE_STRICT; + av_log(s, strict ? AV_LOG_ERROR : AV_LOG_WARNING, + "got %d channel descriptions when number of channels is %d\n", num_descr, nb_channels); + if (strict) + return AVERROR_INVALIDDATA; + av_log(s, AV_LOG_WARNING, "capping channel descriptions to the number of channels\n"); num_descr = nb_channels; } _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
