From a1c7aae91bef9822515f9fdebe5c624d1fdf300a Mon Sep 17 00:00:00 2001 From: Dale Curtis Date: Fri, 2 Aug 2024 22:04:46 +0000 Subject: [PATCH] Fix nullptr dereference with invalid encryption metadata. Found by fuzzer. Bug: https://crbug.com/356720789 Signed-off-by: Dale Curtis --- libavformat/mov.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 1052691936..2df903a208 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -8143,15 +8143,19 @@ static int cenc_filter(MOVContext *mov, AVStream* st, MOVStreamContext *sc, AVPa return AVERROR_INVALIDDATA; } + encrypted_sample = NULL; if (!encryption_index->nb_encrypted_samples) { // Full-sample encryption with default settings. encrypted_sample = sc->cenc.default_encrypted_sample; } else if (encrypted_index >= 0 && encrypted_index < encryption_index->nb_encrypted_samples) { // Per-sample setting override. encrypted_sample = encryption_index->encrypted_samples[encrypted_index]; - if (!encrypted_sample) + if (!encrypted_sample) { encrypted_sample = sc->cenc.default_encrypted_sample; - } else { + } + } + + if (!encrypted_sample) { av_log(mov->fc, AV_LOG_ERROR, "Incorrect number of samples in encryption info\n"); return AVERROR_INVALIDDATA; } -- 2.46.0.rc2.264.g509ed76dc8-goog