Fixes: double free Fixes: 393523547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-6740617236905984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/aac/aacdec.c | 19 +++++++++++++++++-- libavcodec/aac/aacdec_usac.c | 3 ++- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c index 8d50ad6d095..16259b5ada9 100644 --- a/libavcodec/aac/aacdec.c +++ b/libavcodec/aac/aacdec.c @@ -421,6 +421,21 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags) return layout; } +static void copy_oc(OutputConfiguration *dst, OutputConfiguration *src) +{ + int err = 0; + + for(int i = 0; i < dst->usac.nb_elems; i++) + av_freep(&dst->usac.elems[i].ext.pl_data); + + *dst = *src; + + for(int i = 0; i < dst->usac.nb_elems; i++) { + AACUsacElemConfig *e = &dst->usac.elems[i]; + e->ext.pl_data = av_memdup(e->ext.pl_data, e->ext.pl_data_offset); + } +} + /** * Save current output configuration if and only if it has been locked. */ @@ -429,7 +444,7 @@ static int push_output_configuration(AACDecContext *ac) int pushed = 0; if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) { - ac->oc[0] = ac->oc[1]; + copy_oc(&ac->oc[0], &ac->oc[1]); pushed = 1; } ac->oc[1].status = OC_NONE; @@ -443,7 +458,7 @@ static int push_output_configuration(AACDecContext *ac) static void pop_output_configuration(AACDecContext *ac) { if (ac->oc[1].status != OC_LOCKED && ac->oc[0].status != OC_NONE) { - ac->oc[1] = ac->oc[0]; + copy_oc(&ac->oc[1], &ac->oc[0]); ac->avctx->ch_layout = ac->oc[1].ch_layout; ff_aac_output_configure(ac, ac->oc[1].layout_map, ac->oc[1].layout_map_tags, ac->oc[1].status, 0); diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c index ccdf58bc8e2..e6f86b4a677 100644 --- a/libavcodec/aac/aacdec_usac.c +++ b/libavcodec/aac/aacdec_usac.c @@ -1604,7 +1604,8 @@ static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e, if (!(pl_frag_start && pl_frag_end)) { tmp = av_realloc(e->ext.pl_data, e->ext.pl_data_offset + len); if (!tmp) { - av_free(e->ext.pl_data); + av_freep(&e->ext.pl_data); + e->ext.pl_data_offset = 0; return AVERROR(ENOMEM); } e->ext.pl_data = tmp; -- 2.48.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
