[FFmpeg-cvslog] avformat/iamf_parse: keep substream count consistent

James Almer git at videolan.org
Fri Jul 19 05:46:57 EEST 2024


ffmpeg | branch: release/7.0 | James Almer <jamrial at gmail.com> | Sun Jun 23 23:27:29 2024 +0200| [507348799c9cc78fec4d67e0f6f935f2e5e760a1] | committer: James Almer

avformat/iamf_parse: keep substream count consistent

Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct IAMFSubStream')
Fixes: 69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit b248dace929e97b10de17663caab32fbb1c42f0f)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=507348799c9cc78fec4d67e0f6f935f2e5e760a1
---

 libavformat/iamf_parse.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index d52dec792b..2d48d4c177 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -594,7 +594,7 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
     FFIOContext b;
     AVIOContext *pbc;
     uint8_t *buf;
-    unsigned audio_element_id, codec_config_id, num_parameters;
+    unsigned audio_element_id, nb_substreams, codec_config_id, num_parameters;
     int audio_element_type, ret;
 
     buf = av_malloc(len);
@@ -649,14 +649,15 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
         goto fail;
     }
 
-    audio_element->nb_substreams = ffio_read_leb(pbc);
+    nb_substreams = ffio_read_leb(pbc);
     audio_element->codec_config_id = codec_config_id;
     audio_element->audio_element_id = audio_element_id;
-    audio_element->substreams = av_calloc(audio_element->nb_substreams, sizeof(*audio_element->substreams));
+    audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams));
     if (!audio_element->substreams) {
         ret = AVERROR(ENOMEM);
         goto fail;
     }
+    audio_element->nb_substreams = nb_substreams;
 
     element = audio_element->element = av_iamf_audio_element_alloc();
     if (!element) {



More information about the ffmpeg-cvslog mailing list