If sc->tts_count is not 0, then the sample index has already been built. Fixes: Null-dereference READ Fixes: 396192874/clusterfuzz-testcase-minimized-audio_decoder_fuzzer-4589309789143040
Unified · Split
| @@ -4688,7 +4688,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st) · 4687 unmodified lines | |||
| 4688 | 4688 | ||
| 4689 | /* only use old uncompressed audio chunk demuxing when stts specifies it */ | 4689 | /* only use old uncompressed audio chunk demuxing when stts specifies it */ |
| 4690 | if (!(st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO && | 4690 | if (!(st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO && |
| 4691 | sc->stts_count == 1 && sc->stts_data[0].duration == 1)) { | 4691 | sc->stts_count == 1 && sc->stts_data && sc->stts_data[0].duration == 1)) { |
| 4692 | unsigned int current_sample = 0; | 4692 | unsigned int current_sample = 0; |
| 4693 | unsigned int stts_sample = 0; | 4693 | unsigned int stts_sample = 0; |
| 4694 | unsigned int sample_size; | 4694 | unsigned int sample_size; |
| @@ -4700,7 +4700,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st) · 5 unmodified lines | |||
| 4700 | 4700 | ||
| 4701 | current_dts -= sc->dts_shift; | 4701 | current_dts -= sc->dts_shift; |
| 4702 | 4702 | ||
| 4703 | if (!sc->sample_count || sti->nb_index_entries) | 4703 | if (!sc->sample_count || sti->nb_index_entries || sc->tts_count) |
| 4704 | return; | 4704 | return; |
| 4705 | if (sc->sample_count >= UINT_MAX / sizeof(*sti->index_entries) - sti->nb_index_entries) | 4705 | if (sc->sample_count >= UINT_MAX / sizeof(*sti->index_entries) - sti->nb_index_entries) |
| 4706 | return; | 4706 | return; |
| @@ -4811,11 +4811,11 @@ static void mov_build_index(MOVContext *mov, AVStream *st) · 104 unmodified lines | |||
| 4811 | } else { | 4811 | } else { |
| 4812 | unsigned chunk_samples, total = 0; | 4812 | unsigned chunk_samples, total = 0; |
| 4813 | 4813 | ||
| 4814 | ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS); | 4814 | if (!sc->chunk_count || sc->tts_count) |
| 4815 | if (ret < 0) | ||
| 4816 | return; | 4815 | return; |
| 4817 | 4816 | ||
| 4818 | if (!sc->chunk_count) | 4817 | ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS); |
| 4818 | if (ret < 0) | ||
| 4819 | return; | 4819 | return; |
| 4820 | 4820 | ||
| 4821 | // compute total chunk count | 4821 | // compute total chunk count |