On 4/26/2024 12:08 AM, Michael Niedermayer wrote:
Fixes: Null pointer dereference
Fixes:
67861/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5352628142800896
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavformat/mov.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index ecd29a7d08b..97a24e6737e 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -9289,6 +9289,9 @@ static int read_image_grid(AVFormatContext *s, const
HEIFGrid *grid,
if (tile_grid->nb_tiles != size)
return AVERROR_INVALIDDATA;
+ for (int i = 0; i < size; i++)
+ if (!grid->tile_item_list[i])
+ return AVERROR_INVALIDDATA;
for (int i = 0; i < tile_cols; i++)
tile_grid->coded_width += grid->tile_item_list[i]->width;
for (int i = 0; i < size; i += tile_cols)
We shouldn't get this far if that's NULL. Does the following also work?
diff --git a/libavformat/mov.c b/libavformat/mov.c
index ecd29a7d08..b21c4b6f3c 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -9440,7 +9440,7 @@ static int mov_parse_tiles(AVFormatContext *s)
break;
}
- if (k == grid->nb_tiles) {
+ if (k == mov->nb_heif_item) {
av_log(s, AV_LOG_WARNING, "HEIF item id %d referenced by grid id %d
doesn't "
"exist\n",
tile_id, grid->item->item_id);
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
