Fixes: out of array read Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Previous version reviewed-by: Alex Converse <alex.converse@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Showing the changes to libavcodec (1 of 1 file). Show all
Unified · Split
| @@ -1281,6 +1281,8 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics, · 1280 unmodified lines | ||
| 1281 | 1281 | const MPEG4AudioConfig *const m4ac = &ac->oc[1].m4ac; |
| 1282 | 1282 | const int aot = m4ac->object_type; |
| 1283 | 1283 | const int sampling_index = m4ac->sampling_index; |
| 1284 | + int ret_fail = AVERROR_INVALIDDATA; | |
| 1285 | + | |
| 1284 | 1286 | if (aot != AOT_ER_AAC_ELD) { |
| 1285 | 1287 | if (get_bits1(gb)) { |
| 1286 | 1288 | av_log(ac->avctx, AV_LOG_ERROR, "Reserved bit set.\n"); |
| @@ -1331,8 +1333,10 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics, · 44 unmodified lines | ||
| 1331 | 1333 | ics->num_swb = ff_aac_num_swb_512[sampling_index]; |
| 1332 | 1334 | ics->tns_max_bands = ff_tns_max_bands_512[sampling_index]; |
| 1333 | 1335 | } |
| 1334 | − if (!ics->num_swb || !ics->swb_offset) | |
| 1335 | − return AVERROR_BUG; | |
| 1336 | + if (!ics->num_swb || !ics->swb_offset) { | |
| 1337 | + ret_fail = AVERROR_BUG; | |
| 1338 | + goto fail; | |
| 1339 | + } | |
| 1336 | 1340 | } else { |
| 1337 | 1341 | ics->swb_offset = ff_swb_offset_1024[sampling_index]; |
| 1338 | 1342 | ics->num_swb = ff_aac_num_swb_1024[sampling_index]; |
| @@ -1356,7 +1360,8 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics, · 17 unmodified lines | ||
| 1356 | 1360 | if (aot == AOT_ER_AAC_LD) { |
| 1357 | 1361 | av_log(ac->avctx, AV_LOG_ERROR, |
| 1358 | 1362 | "LTP in ER AAC LD not yet implemented.\n"); |
| 1359 | − return AVERROR_PATCHWELCOME; | |
| 1363 | + ret_fail = AVERROR_PATCHWELCOME; | |
| 1364 | + goto fail; | |
| 1360 | 1365 | } |
| 1361 | 1366 | if ((ics->ltp.present = get_bits(gb, 1))) |
| 1362 | 1367 | decode_ltp(&ics->ltp, gb, ics->max_sfb); |
| @@ -1375,7 +1380,7 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics, · 12 unmodified lines | ||
| 1375 | 1380 | return 0; |
| 1376 | 1381 | fail: |
| 1377 | 1382 | ics->max_sfb = 0; |
| 1378 | − return AVERROR_INVALIDDATA; | |
| 1383 | + return ret_fail; | |
| 1379 | 1384 | } |
| 1380 | 1385 | |
| 1381 | 1386 | /** |