virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

avformat/mov: further ensure mov_build_index isn't run twice

Browse Source 
If sc->tts_count is not 0, then the sample index has already been built.

Fixes: Null-dereference READ
Fixes: 396192874/clusterfuzz-testcase-minimized-audio_decoder_fuzzer-4589309789143040

Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer
2025-02-13 23:49:20 -03:00
parent 7e84865cff
commit 261ec6c35e
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavformat/mov.c
View File

@ -4688,7 +4688,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
/* only use old uncompressed audio chunk demuxing when stts specifies it */ /* only use old uncompressed audio chunk demuxing when stts specifies it */
if (!(st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO && if (!(st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO &&
sc->stts_count == 1 && sc->stts_data[0].duration == 1)) { sc->stts_count == 1 && sc->stts_data && sc->stts_data[0].duration == 1)) {
unsigned int current_sample = 0; unsigned int current_sample = 0;
unsigned int stts_sample = 0; unsigned int stts_sample = 0;
unsigned int sample_size; unsigned int sample_size;
@ -4700,7 +4700,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
current_dts -= sc->dts_shift; current_dts -= sc->dts_shift;
if (!sc->sample_count || sti->nb_index_entries) if (!sc->sample_count || sti->nb_index_entries || sc->tts_count)
return; return;
if (sc->sample_count >= UINT_MAX / sizeof(*sti->index_entries) - sti->nb_index_entries) if (sc->sample_count >= UINT_MAX / sizeof(*sti->index_entries) - sti->nb_index_entries)
return; return;
@ -4811,11 +4811,11 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
} else { } else {
unsigned chunk_samples, total = 0; unsigned chunk_samples, total = 0;
ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS); if (!sc->chunk_count || sc->tts_count)
if (ret < 0)
return; return;
if (!sc->chunk_count) ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS);
if (ret < 0)
return; return;
// compute total chunk count // compute total chunk count