ffmpeg | branch: release/7.1 | James Almer <jamr...@gmail.com> | Mon Feb 17 11:41:25 2025 -0300| [9abf2aef37a4c1bd81f89a9ff76dfee3e61710e6] | committer: James Almer
avformat/iamf_parse: ensure there's at most one of each parameter types in audio elements Should prevent potential memory leaks on invalid files. Signed-off-by: James Almer <jamr...@gmail.com> (cherry picked from commit 5470d024e18968b3bdef2b745966f7617f1eb9f2) > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9abf2aef37a4c1bd81f89a9ff76dfee3e61710e6 --- libavformat/iamf_parse.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 7c784c6955..7b3b1e87fa 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -747,11 +747,19 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) type = ffio_read_leb(pbc); if (type == AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN) ret = AVERROR_INVALIDDATA; - else if (type == AV_IAMF_PARAMETER_DEFINITION_DEMIXING) + else if (type == AV_IAMF_PARAMETER_DEFINITION_DEMIXING) { + if (element->demixing_info) { + ret = AVERROR_INVALIDDATA; + goto fail; + } ret = param_parse(s, c, pbc, type, audio_element, &element->demixing_info); - else if (type == AV_IAMF_PARAMETER_DEFINITION_RECON_GAIN) + } else if (type == AV_IAMF_PARAMETER_DEFINITION_RECON_GAIN) { + if (element->recon_gain_info) { + ret = AVERROR_INVALIDDATA; + goto fail; + } ret = param_parse(s, c, pbc, type, audio_element, &element->recon_gain_info); - else { + } else { unsigned param_definition_size = ffio_read_leb(pbc); avio_skip(pbc, param_definition_size); } _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
