[FFmpeg-devel] [PATCH] avcodec/amr_parser: passthrough if channels is unknown

[Andreas Rheinhardt]

James Almer:
> On 10/5/2021 5:51 PM, Michael Niedermayer wrote:
>> Fixes: division by 0
>> Fixes:
>> 39562/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMRWB_fuzzer-5448834960982016
>>
>> Fixes:
>> 39589/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMRWB_fuzzer-6119205334810624
>>
>>
>> Found-by: continuous fuzzing process
>> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
>> ---
>>   libavcodec/amr_parser.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/libavcodec/amr_parser.c b/libavcodec/amr_parser.c
>> index 79258d4d0cf..9fb7711fee0 100644
>> --- a/libavcodec/amr_parser.c
>> +++ b/libavcodec/amr_parser.c
>> @@ -62,7 +62,7 @@ static int amr_parse(AVCodecParserContext *s1,
>>       *poutbuf_size = 0;
>>       *poutbuf = NULL;
>>   -    if (s1->flags & PARSER_FLAG_COMPLETE_FRAMES) {
>> +    if (s1->flags & PARSER_FLAG_COMPLETE_FRAMES || !avctx->channels) {
> 
> No line in the parser divides by avctx->channels. There's however one
> doing a modulo avctx->channels. Wouldn't this mean the compiler is being
> overzealous with optimizations?
> 

No. foo % 0 makes no sense and is undefined behaviour; this is even
stated in the same sentence of the spec: "In both operations, if the
value of
 the second operand is zero, the behavior is undefined."

- Andreas