[FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check

[Paul B Mahol]

On 9/30/22, Michael Niedermayer <michael at niedermayer.cc> wrote:
> Fixes: out of array access
> Fixes:
> 51648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-4644322217164800
>


Make sure that this "fix"
does not break Mono.thd decoding.
The sample is on trac ticket.

Thanks.

> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/mlpdec.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
> index 635f92895c5..0b0eb759901 100644
> --- a/libavcodec/mlpdec.c
> +++ b/libavcodec/mlpdec.c
> @@ -547,6 +547,9 @@ static int read_restart_header(MLPDecodeContext *m,
> GetBitContext *gbp,
>          return AVERROR_PATCHWELCOME;
>      }
>
> +    if (max_channel + 1 > MAX_CHANNELS || max_channel + 1 < min_channel)
> +        return AVERROR_INVALIDDATA;
> +
>      s->min_channel        = min_channel;
>      s->max_channel        = max_channel;
>      s->coded_channels     = ((1LL << (max_channel - min_channel + 1)) - 1)
> << min_channel;
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>