virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avcodec/wmalosslessdec: Check channels after setting them

Browse Source 
Fixes: 46194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-580292873827123
Fixes: stack-buffer-overflow on address 0x7ffc0ce69b30 at pc 0x00000062fb03 bp 0x7ffc0ce69af0 sp 0x7ffc0ce69ae8
Fixes: 46205/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5354894996930560
Fixes: 47861/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4817404984688640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2022-03-31 23:42:32 +02:00
parent 5d5a014199
commit 5d6cdb015e
1 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/wmalosslessdec.c
View File

@@ -191,13 +191,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
return AVERROR(EINVAL); return AVERROR(EINVAL);
} }
av_assert0(avctx->ch_layout.nb_channels >= 0);
if (avctx->ch_layout.nb_channels > WMALL_MAX_CHANNELS) {
avpriv_request_sample(avctx,
"More than " AV_STRINGIFY(WMALL_MAX_CHANNELS) " channels");
return AVERROR_PATCHWELCOME;
}
if (avctx->extradata_size >= 18) { if (avctx->extradata_size >= 18) {
s->decode_flags = AV_RL16(edata_ptr + 14); s->decode_flags = AV_RL16(edata_ptr + 14);
channel_mask = AV_RL32(edata_ptr + 2); channel_mask = AV_RL32(edata_ptr + 2);
@@ -226,6 +219,12 @@ static av_cold int decode_init(AVCodecContext *avctx)
av_channel_layout_uninit(&avctx->ch_layout); av_channel_layout_uninit(&avctx->ch_layout);
av_channel_layout_from_mask(&avctx->ch_layout, channel_mask); av_channel_layout_from_mask(&avctx->ch_layout, channel_mask);
} }
av_assert0(avctx->ch_layout.nb_channels >= 0);
if (avctx->ch_layout.nb_channels > WMALL_MAX_CHANNELS) {
avpriv_request_sample(avctx,
"More than " AV_STRINGIFY(WMALL_MAX_CHANNELS) " channels");
return AVERROR_PATCHWELCOME;
}
s->num_channels = avctx->ch_layout.nb_channels; s->num_channels = avctx->ch_layout.nb_channels;