diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-03-31 23:42:32 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-06-09 20:44:26 +0200 |
| commit | 5d6cdb015e99c83e016b9398c6e0f236067f8248 (patch) | |
| tree | aa26e009fef97cf10aae5b03e0e43a33576c449c /libavcodec/wmalosslessdec.c | |
| parent | 5d5a01419928d0c00bae54f730eede150cd5b268 (diff) | |
| download | ffmpeg-5d6cdb015e99c83e016b9398c6e0f236067f8248.tar.gz | |
avcodec/wmalosslessdec: Check channels after setting them
Fixes: 46194/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-580292873827123
Fixes: stack-buffer-overflow on address 0x7ffc0ce69b30 at pc 0x00000062fb03 bp 0x7ffc0ce69af0 sp 0x7ffc0ce69ae8
Fixes: 46205/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5354894996930560
Fixes: 47861/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4817404984688640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/wmalosslessdec.c')
| -rw-r--r-- | libavcodec/wmalosslessdec.c | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c index 9a8d6cc276..16c6713cd4 100644 --- a/libavcodec/wmalosslessdec.c +++ b/libavcodec/wmalosslessdec.c @@ -191,13 +191,6 @@ static av_cold int decode_init(AVCodecContext *avctx) return AVERROR(EINVAL); } - av_assert0(avctx->ch_layout.nb_channels >= 0); - if (avctx->ch_layout.nb_channels > WMALL_MAX_CHANNELS) { - avpriv_request_sample(avctx, - "More than " AV_STRINGIFY(WMALL_MAX_CHANNELS) " channels"); - return AVERROR_PATCHWELCOME; - } - if (avctx->extradata_size >= 18) { s->decode_flags = AV_RL16(edata_ptr + 14); channel_mask = AV_RL32(edata_ptr + 2); @@ -226,6 +219,12 @@ static av_cold int decode_init(AVCodecContext *avctx) av_channel_layout_uninit(&avctx->ch_layout); av_channel_layout_from_mask(&avctx->ch_layout, channel_mask); } + av_assert0(avctx->ch_layout.nb_channels >= 0); + if (avctx->ch_layout.nb_channels > WMALL_MAX_CHANNELS) { + avpriv_request_sample(avctx, + "More than " AV_STRINGIFY(WMALL_MAX_CHANNELS) " channels"); + return AVERROR_PATCHWELCOME; + } s->num_channels = avctx->ch_layout.nb_channels; |