[FFmpeg-cvslog] avcodec/hcadec: do not set hfr_group_count to invalid values

[Michael Niedermayer]

ffmpeg | branch: release/6.0 | Michael Niedermayer <michael at niedermayer.cc> | Tue Mar 26 01:46:02 2024 +0100| [055265fed1bb34a614f6d9f5d1ffbaa92a55d895] | committer: Michael Niedermayer

avcodec/hcadec: do not set hfr_group_count to invalid values

Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-6247136417087488
Fixes: out of array write

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit addb85ea39300c36010ffb6dc0d28b2ea62b4805)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=055265fed1bb34a614f6d9f5d1ffbaa92a55d895
---

 libavcodec/hcadec.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavcodec/hcadec.c b/libavcodec/hcadec.c
index 2f019a8214..e2885846f5 100644
--- a/libavcodec/hcadec.c
+++ b/libavcodec/hcadec.c
@@ -109,6 +109,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
     float scale = 1.f / 8.f;
     unsigned b, chunk;
     int version, ret;
+    unsigned hfr_group_count;
 
     avctx->sample_fmt = AV_SAMPLE_FMT_FLTP;
     c->crc_table = av_crc_get_table(AV_CRC_16_ANSI);
@@ -229,11 +230,12 @@ static av_cold int decode_init(AVCodecContext *avctx)
     if (c->total_band_count < c->base_band_count)
         return AVERROR_INVALIDDATA;
 
-    c->hfr_group_count = ceil2(c->total_band_count - (c->base_band_count + c->stereo_band_count),
+    hfr_group_count = ceil2(c->total_band_count - (c->base_band_count + c->stereo_band_count),
                                c->bands_per_hfr_group);
 
-    if (c->base_band_count + c->stereo_band_count + (unsigned long)c->hfr_group_count > 128ULL)
+    if (c->base_band_count + c->stereo_band_count + (uint64_t)hfr_group_count > 128ULL)
         return AVERROR_INVALIDDATA;
+    c->hfr_group_count = hfr_group_count;
 
     for (int i = 0; i < avctx->ch_layout.nb_channels; i++) {
         c->ch[i].chan_type = r[i];