avformat/aiffdec: Check for previously set channels

Fixes: out of array access (av_channel_layout_copy()) Fixes: 67087/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-4920720268263424

Michael Niedermayer committed 2 years ago

Commit 23b29f71 parent f30fe5e1 file · +2 −0Browse files

Showing the changes to libavformat (1 of 1 file). Show all

Unified · Split

@@ -107,6 +107,8 @@ static int get_aiff_header(AVFormatContext *s, int64_t size, · 106 unmodified lines
107	107	size++;
108	108	par->codec_type = AVMEDIA_TYPE_AUDIO;
109	109	channels = avio_rb16(pb);
	110	+ if (par->ch_layout.nb_channels && par->ch_layout.nb_channels != channels)
	111	+ return AVERROR_INVALIDDATA;
110	112	par->ch_layout.nb_channels = channels;
111	113	num_frames = avio_rb32(pb);
112	114	par->bits_per_coded_sample = avio_rb16(pb);

Keyboard shortcuts