Commit Graph

15 Commits

Author SHA1 Message Date
James Almer
0ae157b360 avformat/iamf_parse: add missing padding to AAC extradata
Fixes: out of array access
Fixes: 68863/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-4833546039525376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
2024-06-19 10:12:57 -03:00
Michael Niedermayer
7fab9b9761
avformat/iamf_parse: 0 layers are not allowed
Fixes: out of array access
Fixes: 68302/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4665793796177920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-19 12:54:46 +02:00
Michael Niedermayer
c69e6cccd7
avformat/iamf_parse: consider nb_substreams when accessing substreams array
Fixes: out of array access
Fixes: 68584/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6256656668229632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-19 12:52:20 +02:00
Michael Niedermayer
c21fb3624b
avformat/iamf_parse: Remove dead case
Fixes: CID1559546 Logically dead code

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-12 00:39:11 +02:00
Michael Niedermayer
4593cf7ab3
avformat/iamf_parse: Check sound_system
Fixes: index 13 out of bounds for type 'const struct IAMFSoundSystemMap [13]'
Fixes: 67796/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-4554553191104512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-04 19:38:29 +02:00
James Almer
0a693bce62
avformat/iamf_parse: keep count_label consistent on language_label allocation failure
Fixes: null pointer dereference
Fixes: 67023/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6011025237278720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-01 18:17:28 +02:00
Andreas Rheinhardt
790f793844 avutil/common: Don't auto-include mem.h
There are lots of files that don't need it: The number of object
files that actually need it went down from 2011 to 884 here.

Keep it for external users in order to not cause breakages.

Also improve the other headers a bit while just at it.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-03-31 00:08:43 +01:00
James Almer
56d630e6c2 avformat/iamf_writer: update extradata from packet side data
Some encoders, like flac, propagate updated extradata at the end of encoding
as packet side data. Use it to update the relevant codec_config.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-03-04 21:14:05 -03:00
James Almer
80131321c4 avformat/iamfdec: set disposition flags to output streams
if there's an audio layer with a single stream that can be rendered alone, mark it
as default. Otherwise, mark every stream as dependent.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-02-19 20:53:36 -03:00
Andreas Rheinhardt
18af922c53 avformat/iamf: Don't mix ownership and non-ownership pointers
IAMFAudioElement and IAMFMixPresentation currently contain
pointers to independently allocated objects that are sometimes
owned by said structures and sometimes not.

More precisely, upon success the demuxer transfers ownership
of these other objects newly created AVStreamGroups, but it
keeps its pointers. iamf_read_close() therefore always resets
these pointers (because the cleanup code always treats them
as ownership pointers). This leads to memory leaks in case
iamf_read_header() without having attached all of these
objects to stream groups.

The muxer has a similar issue: It also clears these pointers
(pointing to objects owned by stream groups created by the user)
in its deinit function.

This commit fixes this memleak by explicitly adding non-ownership
pointers; this also allows to remove the code to reset the
ownership pointers.

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-02-19 23:30:00 +01:00
James Almer
fa469545ba avcodec: move leb reading functions to its own header
Signed-off-by: James Almer <jamrial@gmail.com>
2024-01-31 11:19:16 -03:00
James Almer
0b8e51b584 avformat/iamf_parse: use the public iamf helpers to allocate structs
Should fix memory leaks from non-freed fields due to missing AVClass
in the allocated structs.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-01-23 20:57:41 -03:00
Paul B Mahol
04cb307508 avformat/iamf_parse: fix yet annother logical coding error
Signed-off-by: James Almer <jamrial@gmail.com>
2023-12-21 12:24:54 -03:00
Paul B Mahol
7a9aafde3d avformat/iamf_parse: fix another logical coding error
Signed-off-by: James Almer <jamrial@gmail.com>
2023-12-21 11:39:24 -03:00
James Almer
4ee05182b7 avformat: Immersive Audio Model and Formats demuxer
Signed-off-by: James Almer <jamrial@gmail.com>
2023-12-18 15:20:59 -03:00