Fixes: index 9 out of bounds for type 'uint32_t [8][8]' Fixes: 70363/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-6723855293415424.fuzz
Unified · Split
| @@ -130,6 +130,9 @@ int ff_aac_parse_fac_data(AACUsacElemData *ce, GetBitContext *gb, · 129 unmodified lines | ||
| 130 | 130 | if (use_gain) |
| 131 | 131 | ce->fac.gain = get_bits(gb, 7); |
| 132 | 132 | |
| 133 | + if (len/8 > 8) | |
| 134 | + return AVERROR_PATCHWELCOME; | |
| 135 | + | |
| 133 | 136 | for (int i = 0; i < len/8; i++) { |
| 134 | 137 | ret = parse_codebook_idx(gb, ce->fac.kv[i], 1, 1); |
| 135 | 138 | if (ret < 0) |