[FFmpeg-devel] [PATCH 1/6] avformat/isom: Uninit layout in ff_mp4_read_dec_config_descr()

[James Almer]

On 4/1/2024 5:56 PM, Michael Niedermayer wrote:
> Fixes: memleak
> Fixes: 67442/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5068813261406208
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>   libavformat/isom.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/libavformat/isom.c b/libavformat/isom.c
> index 9fbccd4437f..c5930bd4d87 100644
> --- a/libavformat/isom.c
> +++ b/libavformat/isom.c
> @@ -359,6 +359,7 @@ int ff_mp4_read_dec_config_descr(AVFormatContext *fc, AVStream *st, AVIOContext
>                                                   st->codecpar->extradata_size, 1, fc);
>               if (ret < 0)
>                   return ret;
> +            av_channel_layout_uninit(&st->codecpar->ch_layout);
>               st->codecpar->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC;

Not strictly related to this fix, but should we really drop the layout 
here by forcing unspec? We're also not even bothering to check if 
cfg.channels matches st->codecpar->ch_layout.nb_channels.

>               st->codecpar->ch_layout.nb_channels = cfg.channels;
>               if (cfg.object_type == 29 && cfg.sampling_index < 3) // old mp3on4