virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-24 13:56:33 +02:00
Code Issues Releases Activity

avformat/iamf_parse: Check for negative sample sizes

Browse Source 
Fixes: index -2 out of bounds for type 'const enum AVCodecID [3]'
Fixes: 69866/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-4971166119821312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9b9e02f2ff6575e934e8e991a471b3086d1c0d53)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-07-17 00:56:58 +02:00
parent b926b87f3c
commit ca19dbf33d
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/iamf_parse.c
View File

@ -152,7 +152,7 @@ static int ipcm_decoder_config(IAMFCodecConfig *codec_config,
}; };
int sample_format = avio_r8(pb); // 0 = BE, 1 = LE int sample_format = avio_r8(pb); // 0 = BE, 1 = LE
int sample_size = (avio_r8(pb) / 8 - 2); // 16, 24, 32 int sample_size = (avio_r8(pb) / 8 - 2); // 16, 24, 32
if (sample_format > 1 || sample_size > 2 || codec_config->audio_roll_distance) if (sample_format > 1 || sample_size > 2U || codec_config->audio_roll_distance)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
codec_config->codec_id = sample_fmt[sample_format][sample_size]; codec_config->codec_id = sample_fmt[sample_format][sample_size];