From 3e6cec12865d53ebdb5e5bf344ebfc4f4b9ccb85 Mon Sep 17 00:00:00 2001 From: James Almer Date: Tue, 17 Sep 2024 15:39:57 -0300 Subject: [PATCH] avformat/mov_chan: add extra checks to channel description count Make sure it's not zero, and equal or bigger than number of channels Fixes: Timeout / DOS Fixes: 67143/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-4858720481771520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: James Almer (cherry picked from commit 1c706cec46b8fe500c76f4cb5efbafccf47cfe20) --- libavformat/mov_chan.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/libavformat/mov_chan.c b/libavformat/mov_chan.c index 287059d65b..3c7274b737 100644 --- a/libavformat/mov_chan.c +++ b/libavformat/mov_chan.c @@ -462,10 +462,22 @@ int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st, return 0; if (layout_tag == MOV_CH_LAYOUT_USE_DESCRIPTIONS) { - int nb_channels = ch_layout->nb_channels ? ch_layout->nb_channels : num_descr; - if (num_descr > nb_channels) { - av_log(s, AV_LOG_WARNING, "got %d channel descriptions, capping to the number of channels %d\n", + int nb_channels = ch_layout->nb_channels; + + if (!num_descr || num_descr < nb_channels) { + av_log(s, AV_LOG_ERROR, "got %d channel descriptions when at least %d were needed\n", num_descr, nb_channels); + return AVERROR_INVALIDDATA; + } + + if (num_descr > nb_channels) { + int strict = s->strict_std_compliance >= FF_COMPLIANCE_STRICT; + av_log(s, strict ? AV_LOG_ERROR : AV_LOG_WARNING, + "got %d channel descriptions when number of channels is %d\n", + num_descr, nb_channels); + if (strict) + return AVERROR_INVALIDDATA; + av_log(s, AV_LOG_WARNING, "capping channel descriptions to the number of channels\n"); num_descr = nb_channels; }