[FFmpeg-cvslog] avcodec/aacdec_template: Fix running cleanup in decode_ics_info()
Michael Niedermayer
git at videolan.org
Sun Sep 17 17:50:24 EEST 2017
ffmpeg | branch: release/3.1 | Michael Niedermayer <michael at niedermayer.cc> | Mon Aug 21 02:15:49 2017 +0200| [1fa31e28fd5d8d5c8e784b9e6c84c1ec7bffd3d4] | committer: Michael Niedermayer
avcodec/aacdec_template: Fix running cleanup in decode_ics_info()
Fixes: out of array read
Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Previous version reviewed-by: Alex Converse <alex.converse at gmail.com>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 6f03ffb47d51368a4bbc87702df8446e4660845d)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1fa31e28fd5d8d5c8e784b9e6c84c1ec7bffd3d4
---
libavcodec/aacdec_template.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c
index b3ce500973..7819d710bf 100644
--- a/libavcodec/aacdec_template.c
+++ b/libavcodec/aacdec_template.c
@@ -1255,6 +1255,8 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
const MPEG4AudioConfig *const m4ac = &ac->oc[1].m4ac;
const int aot = m4ac->object_type;
const int sampling_index = m4ac->sampling_index;
+ int ret_fail = AVERROR_INVALIDDATA;
+
if (aot != AOT_ER_AAC_ELD) {
if (get_bits1(gb)) {
av_log(ac->avctx, AV_LOG_ERROR, "Reserved bit set.\n");
@@ -1305,8 +1307,10 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
ics->num_swb = ff_aac_num_swb_512[sampling_index];
ics->tns_max_bands = ff_tns_max_bands_512[sampling_index];
}
- if (!ics->num_swb || !ics->swb_offset)
- return AVERROR_BUG;
+ if (!ics->num_swb || !ics->swb_offset) {
+ ret_fail = AVERROR_BUG;
+ goto fail;
+ }
} else {
ics->swb_offset = ff_swb_offset_1024[sampling_index];
ics->num_swb = ff_aac_num_swb_1024[sampling_index];
@@ -1330,7 +1334,8 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
if (aot == AOT_ER_AAC_LD) {
av_log(ac->avctx, AV_LOG_ERROR,
"LTP in ER AAC LD not yet implemented.\n");
- return AVERROR_PATCHWELCOME;
+ ret_fail = AVERROR_PATCHWELCOME;
+ goto fail;
}
if ((ics->ltp.present = get_bits(gb, 1)))
decode_ltp(&ics->ltp, gb, ics->max_sfb);
@@ -1349,7 +1354,7 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
return 0;
fail:
ics->max_sfb = 0;
- return AVERROR_INVALIDDATA;
+ return ret_fail;
}
/**
More information about the ffmpeg-cvslog
mailing list