[FFmpeg-devel] [PATCH 5/5] avformat/iamf: Check substreams in ff_iamf_free_audio_element()

[Michael Niedermayer]

Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct IAMFSubStream')
Fixes: 69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavformat/iamf.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavformat/iamf.c b/libavformat/iamf.c
index 5de70dc0828..364cb60e021 100644
--- a/libavformat/iamf.c
+++ b/libavformat/iamf.c
@@ -74,8 +74,10 @@ void ff_iamf_free_audio_element(IAMFAudioElement **paudio_element)
     if (!audio_element)
         return;
 
-    for (int i = 0; i < audio_element->nb_substreams; i++)
-        avcodec_parameters_free(&audio_element->substreams[i].codecpar);
+    if (audio_element->substreams)
+        for (int i = 0; i < audio_element->nb_substreams; i++) {
+            avcodec_parameters_free(&audio_element->substreams[i].codecpar);
+        }
     av_free(audio_element->substreams);
     av_free(audio_element->layers);
     av_iamf_audio_element_free(&audio_element->element);
-- 
2.45.2