[FFmpeg-cvslog] avformat/mov_chan: add extra checks to channel description count

[James Almer]

ffmpeg | branch: release/7.0 | James Almer <jamrial at gmail.com> | Tue Sep 17 15:39:57 2024 -0300| [3e6cec12865d53ebdb5e5bf344ebfc4f4b9ccb85] | committer: James Almer

avformat/mov_chan: add extra checks to channel description count

Make sure it's not zero, and equal or bigger than number of channels

Fixes: Timeout / DOS
Fixes: 67143/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-4858720481771520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial at gmail.com>
(cherry picked from commit 1c706cec46b8fe500c76f4cb5efbafccf47cfe20)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3e6cec12865d53ebdb5e5bf344ebfc4f4b9ccb85
---

 libavformat/mov_chan.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/libavformat/mov_chan.c b/libavformat/mov_chan.c
index 287059d65b..3c7274b737 100644
--- a/libavformat/mov_chan.c
+++ b/libavformat/mov_chan.c
@@ -462,10 +462,22 @@ int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st,
         return 0;
 
     if (layout_tag == MOV_CH_LAYOUT_USE_DESCRIPTIONS) {
-        int nb_channels = ch_layout->nb_channels ? ch_layout->nb_channels : num_descr;
+        int nb_channels = ch_layout->nb_channels;
+
+        if (!num_descr || num_descr < nb_channels) {
+            av_log(s, AV_LOG_ERROR, "got %d channel descriptions when at least %d were needed\n",
+                   num_descr, nb_channels);
+            return AVERROR_INVALIDDATA;
+        }
+
         if (num_descr > nb_channels) {
-            av_log(s, AV_LOG_WARNING, "got %d channel descriptions, capping to the number of channels %d\n",
+            int strict = s->strict_std_compliance >= FF_COMPLIANCE_STRICT;
+            av_log(s, strict ? AV_LOG_ERROR : AV_LOG_WARNING,
+                   "got %d channel descriptions when number of channels is %d\n",
                    num_descr, nb_channels);
+            if (strict)
+                return AVERROR_INVALIDDATA;
+            av_log(s, AV_LOG_WARNING, "capping channel descriptions to the number of channels\n");
             num_descr = nb_channels;
         }