ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-09-19 12:56:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/mov_chan: add extra checks to channel description count

Browse Source 
Make sure it's not zero, and equal or bigger than number of channels

Fixes: Timeout / DOS
Fixes: 67143/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-4858720481771520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1c706cec46)
This commit is contained in:
James Almer 2024-09-17 15:39:57 -03:00
parent f705bc5b73
commit 3e6cec1286
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
libavformat/mov_chan.c
View File

@ -462,10 +462,22 @@ int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st,
return 0;
if (layout_tag == MOV_CH_LAYOUT_USE_DESCRIPTIONS) {
int nb_channels = ch_layout->nb_channels ? ch_layout->nb_channels : num_descr;
if (num_descr > nb_channels) {
av_log(s, AV_LOG_WARNING, "got %d channel descriptions, capping to the number of channels %d\n",
int nb_channels = ch_layout->nb_channels;
if (!num_descr || num_descr < nb_channels) {
av_log(s, AV_LOG_ERROR, "got %d channel descriptions when at least %d were needed\n",
num_descr, nb_channels);
return AVERROR_INVALIDDATA;
}
if (num_descr > nb_channels) {
int strict = s->strict_std_compliance >= FF_COMPLIANCE_STRICT;
av_log(s, strict ? AV_LOG_ERROR : AV_LOG_WARNING,
"got %d channel descriptions when number of channels is %d\n",
num_descr, nb_channels);
if (strict)
return AVERROR_INVALIDDATA;
av_log(s, AV_LOG_WARNING, "capping channel descriptions to the number of channels\n");
num_descr = nb_channels;
}