If sc->tts_count is not 0, then the sample index has already been built. Fixes: Null-dereference READ Fixes: 396192874/clusterfuzz-testcase-minimized-audio_decoder_fuzzer-4589309789143040
Unified · Split
| @@ -4688,7 +4688,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st) · 4687 unmodified lines | ||
| 4688 | 4688 | |
| 4689 | 4689 | /* only use old uncompressed audio chunk demuxing when stts specifies it */ |
| 4690 | 4690 | if (!(st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO && |
| 4691 | − sc->stts_count == 1 && sc->stts_data[0].duration == 1)) { | |
| 4691 | + sc->stts_count == 1 && sc->stts_data && sc->stts_data[0].duration == 1)) { | |
| 4692 | 4692 | unsigned int current_sample = 0; |
| 4693 | 4693 | unsigned int stts_sample = 0; |
| 4694 | 4694 | unsigned int sample_size; |
| @@ -4700,7 +4700,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st) · 5 unmodified lines | ||
| 4700 | 4700 | |
| 4701 | 4701 | current_dts -= sc->dts_shift; |
| 4702 | 4702 | |
| 4703 | − if (!sc->sample_count || sti->nb_index_entries) | |
| 4703 | + if (!sc->sample_count || sti->nb_index_entries || sc->tts_count) | |
| 4704 | 4704 | return; |
| 4705 | 4705 | if (sc->sample_count >= UINT_MAX / sizeof(*sti->index_entries) - sti->nb_index_entries) |
| 4706 | 4706 | return; |
| @@ -4811,11 +4811,11 @@ static void mov_build_index(MOVContext *mov, AVStream *st) · 104 unmodified lines | ||
| 4811 | 4811 | } else { |
| 4812 | 4812 | unsigned chunk_samples, total = 0; |
| 4813 | 4813 | |
| 4814 | − ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS); | |
| 4815 | − if (ret < 0) | |
| 4814 | + if (!sc->chunk_count || sc->tts_count) | |
| 4816 | 4815 | return; |
| 4817 | 4816 | |
| 4818 | − if (!sc->chunk_count) | |
| 4817 | + ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS); | |
| 4818 | + if (ret < 0) | |
| 4819 | 4819 | return; |
| 4820 | 4820 | |
| 4821 | 4821 | // compute total chunk count |