eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

avformat/iamf_parse: bound substream count by remaining OBU size

Browse Source 
also check for nb_substreams == 0

Fixes: 472641765/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6390897173659648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe2dabbbf4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-05-30 04:19:41 +02:00
parent 942f897e8a
commit 5ed93579e7
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavformat/iamf_parse.c
+7
View File
@@ -776,6 +776,13 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
}
nb_substreams = ffio_read_leb(pbc);
/* Each substream consumes at least one byte (its leb128 id) from the
* remaining OBU buffer, so a count larger than that cannot be valid and
* would only serve to force an oversized allocation. */
if (nb_substreams > len - avio_tell(pbc) || !nb_substreams) {
ret = AVERROR_INVALIDDATA;
goto fail;
}
audio_element->codec_config_id = codec_config_id;
audio_element->audio_element_id = audio_element_id;
audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams));