The array is only ever needed for streams where each sample entry may have a different value. Given that for non animated HEIF there's a single value that applies to the image, use the field defined for that. Fixes: NULL pointer dereference Fixes: 437528618/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6537287645331456
Unified · Split
| @@ -5456,10 +5456,6 @@ static int heif_add_stream(MOVContext *c, HEIFItem *item) · 5455 unmodified lines | |||
| 5456 | if (!sc->chunk_offsets) | 5456 | if (!sc->chunk_offsets) |
| 5457 | goto fail; | 5457 | goto fail; |
| 5458 | sc->chunk_count = 1; | 5458 | sc->chunk_count = 1; |
| 5459 | sc->sample_sizes = av_malloc_array(1, sizeof(*sc->sample_sizes)); | ||
| 5460 | if (!sc->sample_sizes) | ||
| 5461 | goto fail; | ||
| 5462 | sc->sample_count = 1; | ||
| 5463 | sc->stts_data = av_malloc_array(1, sizeof(*sc->stts_data)); | 5459 | sc->stts_data = av_malloc_array(1, sizeof(*sc->stts_data)); |
| 5464 | if (!sc->stts_data) | 5460 | if (!sc->stts_data) |
| 5465 | goto fail; | 5461 | goto fail; |
| @@ -10471,11 +10467,13 @@ static int mov_parse_heif_items(AVFormatContext *s) · 5005 unmodified lines | |||
| 10471 | st->codecpar->width = item->width; | 10467 | st->codecpar->width = item->width; |
| 10472 | st->codecpar->height = item->height; | 10468 | st->codecpar->height = item->height; |
| 10473 | 10469 | ||
| 10470 | sc->sample_size = sc->stsz_sample_size = item->extent_length; | ||
| 10471 | sc->sample_count = 1; | ||
| 10472 | |||
| 10474 | err = sanity_checks(s, sc, item->item_id); | 10473 | err = sanity_checks(s, sc, item->item_id); |
| 10475 | if (err || !sc->sample_count) | 10474 | if (err) |
| 10476 | return AVERROR_INVALIDDATA; | 10475 | return AVERROR_INVALIDDATA; |
| 10477 | 10476 | ||
| 10478 | sc->sample_sizes[0] = item->extent_length; | ||
| 10479 | sc->chunk_offsets[0] = item->extent_offset + offset; | 10477 | sc->chunk_offsets[0] = item->extent_offset + offset; |
| 10480 | 10478 | ||
| 10481 | if (item->item_id == mov->primary_item_id) | 10479 | if (item->item_id == mov->primary_item_id) |