[FFmpeg-cvslog] mp3on4: fail when the header check fails

Michael Niedermayer git at videolan.org
Thu Jan 2 18:58:00 CET 2014


ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Jan  2 18:45:36 2014 +0100| [c925e960e83dffdfdbb9598bb1a6ba475cb4520d] | committer: Michael Niedermayer

mp3on4: fail when the header check fails

It seems the code assumed that when one out of multiple blocks fail
some span of time is correct, its not, its some channels
that are correct

Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f44a03ba3ce_5692_id5_1.mp4
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c925e960e83dffdfdbb9598bb1a6ba475cb4520d
---

 libavcodec/mpegaudiodec_template.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavcodec/mpegaudiodec_template.c b/libavcodec/mpegaudiodec_template.c
index e0bee53..be8ce6d 100644
--- a/libavcodec/mpegaudiodec_template.c
+++ b/libavcodec/mpegaudiodec_template.c
@@ -1934,8 +1934,10 @@ static int decode_frame_mp3on4(AVCodecContext *avctx, void *data,
         }
         header = (AV_RB32(buf) & 0x000fffff) | s->syncword; // patch header
 
-        if (ff_mpa_check_header(header) < 0) // Bad header, discard block
-            break;
+        if (ff_mpa_check_header(header) < 0) {
+            av_log(avctx, AV_LOG_ERROR, "Bad header, discard block\n");
+            return AVERROR_INVALIDDATA;
+        }
 
         avpriv_mpegaudio_decode_header((MPADecodeHeader *)m, header);
 



More information about the ffmpeg-cvslog mailing list