[FFmpeg-devel] [PATCH 3/3] avcodec/mlpdec: add max channels check
Paul B Mahol
onemda at gmail.com
Fri Sep 30 11:00:57 EEST 2022
On 9/30/22, Michael Niedermayer <michael at niedermayer.cc> wrote:
> Fixes: out of array access
> Fixes:
> 51648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-4644322217164800
>
Make sure that this "fix"
does not break Mono.thd decoding.
The sample is on trac ticket.
Thanks.
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
> libavcodec/mlpdec.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
> index 635f92895c5..0b0eb759901 100644
> --- a/libavcodec/mlpdec.c
> +++ b/libavcodec/mlpdec.c
> @@ -547,6 +547,9 @@ static int read_restart_header(MLPDecodeContext *m,
> GetBitContext *gbp,
> return AVERROR_PATCHWELCOME;
> }
>
> + if (max_channel + 1 > MAX_CHANNELS || max_channel + 1 < min_channel)
> + return AVERROR_INVALIDDATA;
> +
> s->min_channel = min_channel;
> s->max_channel = max_channel;
> s->coded_channels = ((1LL << (max_channel - min_channel + 1)) - 1)
> << min_channel;
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>
More information about the ffmpeg-devel
mailing list