videolan
/
ffmpeg
mirror of https://git.videolan.org/git/ffmpeg.git
1
Fork 0
Code Releases Activity

avcodec/mlpdec: Only change noise_type if the related fields are valid 

Fixes: inconsistency
Fixes:runtime error: index 8 out of bounds for type 'int32_t [8]'
Fixes: 6686/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5191383498358784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-05-17 13:58:46 +02:00
parent 10c8521265
commit 63c4a4b0d6
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/mlpdec.c
View File

@ -479,7 +479,7 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
uint8_t checksum;
uint8_t lossless_check;
int start_count = get_bits_count(gbp);
int min_channel, max_channel, max_matrix_channel;
int min_channel, max_channel, max_matrix_channel, noise_type;
const int std_max_matrix_channel = m->avctx->codec_id == AV_CODEC_ID_MLP
? MAX_MATRIX_CHANNEL_MLP
: MAX_MATRIX_CHANNEL_TRUEHD;
@ -492,9 +492,9 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
return AVERROR_INVALIDDATA;
}
s->noise_type = get_bits1(gbp);
noise_type = get_bits1(gbp);
if (m->avctx->codec_id == AV_CODEC_ID_MLP && s->noise_type) {
if (m->avctx->codec_id == AV_CODEC_ID_MLP && noise_type) {
av_log(m->avctx, AV_LOG_ERROR, "MLP must have 0x31ea sync word.\n");
return AVERROR_INVALIDDATA;
}
@ -520,7 +520,7 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
/* This should happen for TrueHD streams with >6 channels and MLP's noise
* type. It is not yet known if this is allowed. */
if (max_channel > MAX_MATRIX_CHANNEL_MLP && !s->noise_type) {
if (max_channel > MAX_MATRIX_CHANNEL_MLP && !noise_type) {
avpriv_request_sample(m->avctx,
"%d channels (more than the "
"maximum supported by the decoder)",
@ -537,6 +537,7 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
s->min_channel = min_channel;
s->max_channel = max_channel;
s->max_matrix_channel = max_matrix_channel;
s->noise_type = noise_type;
if (mlp_channel_layout_subset(m->avctx->request_channel_layout, s->mask) &&
m->max_decoded_substream > substr) {