[FFmpeg-devel] [PATCH 1/6] avformat/isom: Uninit layout in ff_mp4_read_dec_config_descr()

[James Almer]

On 4/1/2024 8:40 PM, Michael Niedermayer wrote:
> On Mon, Apr 01, 2024 at 06:33:22PM -0300, James Almer wrote:
>> On 4/1/2024 5:56 PM, Michael Niedermayer wrote:
>>> Fixes: memleak
>>> Fixes: 67442/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5068813261406208
>>>
>>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
>>> ---
>>>    libavformat/isom.c | 1 +
>>>    1 file changed, 1 insertion(+)
>>>
>>> diff --git a/libavformat/isom.c b/libavformat/isom.c
>>> index 9fbccd4437f..c5930bd4d87 100644
>>> --- a/libavformat/isom.c
>>> +++ b/libavformat/isom.c
>>> @@ -359,6 +359,7 @@ int ff_mp4_read_dec_config_descr(AVFormatContext *fc, AVStream *st, AVIOContext
>>>                                                    st->codecpar->extradata_size, 1, fc);
>>>                if (ret < 0)
>>>                    return ret;
>>> +            av_channel_layout_uninit(&st->codecpar->ch_layout);
>>>                st->codecpar->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC;
>>
>> Not strictly related to this fix, but should we really drop the layout here
>> by forcing unspec? We're also not even bothering to check if cfg.channels
>> matches st->codecpar->ch_layout.nb_channels.
> 
> I was wondering the same.
> I was hoping someone would know the specs well enouh to just say straight
> "this and that isnt legal together error out if thats true"

Maybe Marton knows, since he's been working on this code.