Fixes: index 9 out of bounds for type 'uint32_t [8][8]' Fixes: 70363/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-6723855293415424.fuzz
Unified · Split
| @@ -130,6 +130,9 @@ int ff_aac_parse_fac_data(AACUsacElemData *ce, GetBitContext *gb, · 129 unmodified lines | |||
| 130 | if (use_gain) | 130 | if (use_gain) |
| 131 | ce->fac.gain = get_bits(gb, 7); | 131 | ce->fac.gain = get_bits(gb, 7); |
| 132 | 132 | ||
| 133 | if (len/8 > 8) | ||
| 134 | return AVERROR_PATCHWELCOME; | ||
| 135 | |||
| 133 | for (int i = 0; i < len/8; i++) { | 136 | for (int i = 0; i < len/8; i++) { |
| 134 | ret = parse_codebook_idx(gb, ce->fac.kv[i], 1, 1); | 137 | ret = parse_codebook_idx(gb, ce->fac.kv[i], 1, 1); |
| 135 | if (ret < 0) | 138 | if (ret < 0) |