On 6/23/2024 8:01 PM, Michael Niedermayer wrote:
Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct
IAMFSubStream')
Fixes:
69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavformat/iamf.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavformat/iamf.c b/libavformat/iamf.c
index 5de70dc0828..364cb60e021 100644
--- a/libavformat/iamf.c
+++ b/libavformat/iamf.c
@@ -74,8 +74,10 @@ void ff_iamf_free_audio_element(IAMFAudioElement
**paudio_element)
if (!audio_element)
return;
- for (int i = 0; i < audio_element->nb_substreams; i++)
- avcodec_parameters_free(&audio_element->substreams[i].codecpar);
+ if (audio_element->nb_substreams)
+ for (int i = 0; i < audio_element->nb_substreams; i++) {
+ avcodec_parameters_free(&audio_element->substreams[i].codecpar);
+ }
av_free(audio_element->substreams);
av_free(audio_element->layers);
av_iamf_audio_element_free(&audio_element->element);
Sorry, i missed this.
nb_substreams shouldn't be anything but 0 here if nb_substreams is NULL,
so the following is IMO better:
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 9cec12d46f..a69d4a2f3a 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -594,7 +594,7 @@ static int audio_element_obu(void *s, IAMFContext *c,
AVIOContext *pb, int len)
FFIOContext b;
AVIOContext *pbc;
uint8_t *buf;
- unsigned audio_element_id, codec_config_id, num_parameters;
+ unsigned audio_element_id, nb_substreams, codec_config_id, num_parameters;
int audio_element_type, ret;
buf = av_malloc(len);
@@ -649,14 +649,15 @@ static int audio_element_obu(void *s, IAMFContext *c,
AVIOContext *pb, int len)
goto fail;
}
- audio_element->nb_substreams = ffio_read_leb(pbc);
+ nb_substreams = ffio_read_leb(pbc);
audio_element->codec_config_id = codec_config_id;
audio_element->audio_element_id = audio_element_id;
- audio_element->substreams = av_calloc(audio_element->nb_substreams,
sizeof(*audio_element->substreams));
+ audio_element->substreams = av_calloc(nb_substreams,
sizeof(*audio_element->substreams));
if (!audio_element->substreams) {
ret = AVERROR(ENOMEM);
goto fail;
}
+ audio_element->nb_substreams = nb_substreams;
element = audio_element->element = av_iamf_audio_element_alloc();
if (!element) {
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
