The array is only ever needed for streams where each sample entry may have a different value. Given that for non animated HEIF there's a single value that applies to the image, use the field defined for that. Fixes: NULL pointer dereference Fixes: 437528618/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6537287645331456
Unified · Split
| @@ -5456,10 +5456,6 @@ static int heif_add_stream(MOVContext *c, HEIFItem *item) · 5455 unmodified lines | ||
| 5456 | 5456 | if (!sc->chunk_offsets) |
| 5457 | 5457 | goto fail; |
| 5458 | 5458 | sc->chunk_count = 1; |
| 5459 | − sc->sample_sizes = av_malloc_array(1, sizeof(*sc->sample_sizes)); | |
| 5460 | − if (!sc->sample_sizes) | |
| 5461 | − goto fail; | |
| 5462 | − sc->sample_count = 1; | |
| 5463 | 5459 | sc->stts_data = av_malloc_array(1, sizeof(*sc->stts_data)); |
| 5464 | 5460 | if (!sc->stts_data) |
| 5465 | 5461 | goto fail; |
| @@ -10471,11 +10467,13 @@ static int mov_parse_heif_items(AVFormatContext *s) · 5005 unmodified lines | ||
| 10471 | 10467 | st->codecpar->width = item->width; |
| 10472 | 10468 | st->codecpar->height = item->height; |
| 10473 | 10469 | |
| 10470 | + sc->sample_size = sc->stsz_sample_size = item->extent_length; | |
| 10471 | + sc->sample_count = 1; | |
| 10472 | + | |
| 10474 | 10473 | err = sanity_checks(s, sc, item->item_id); |
| 10475 | − if (err || !sc->sample_count) | |
| 10474 | + if (err) | |
| 10476 | 10475 | return AVERROR_INVALIDDATA; |
| 10477 | 10476 | |
| 10478 | − sc->sample_sizes[0] = item->extent_length; | |
| 10479 | 10477 | sc->chunk_offsets[0] = item->extent_offset + offset; |
| 10480 | 10478 | |
| 10481 | 10479 | if (item->item_id == mov->primary_item_id) |