[FFmpeg-devel] [PATCH 5/5] avformat/iamf: Check substreams in ff_iamf_free_audio_element()

[James Almer]

On 6/23/2024 8:01 PM, Michael Niedermayer wrote:
> Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct IAMFSubStream')
> Fixes: 69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>   libavformat/iamf.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/libavformat/iamf.c b/libavformat/iamf.c
> index 5de70dc0828..364cb60e021 100644
> --- a/libavformat/iamf.c
> +++ b/libavformat/iamf.c
> @@ -74,8 +74,10 @@ void ff_iamf_free_audio_element(IAMFAudioElement **paudio_element)
>       if (!audio_element)
>           return;
>   
> -    for (int i = 0; i < audio_element->nb_substreams; i++)
> -        avcodec_parameters_free(&audio_element->substreams[i].codecpar);
> +    if (audio_element->nb_substreams)
> +        for (int i = 0; i < audio_element->nb_substreams; i++) {
> +            avcodec_parameters_free(&audio_element->substreams[i].codecpar);
> +        }
>       av_free(audio_element->substreams);
>       av_free(audio_element->layers);
>       av_iamf_audio_element_free(&audio_element->element);

Sorry, i missed this.

nb_substreams shouldn't be anything but 0 here if nb_substreams is NULL, 
so the following is IMO better:

> diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
> index 9cec12d46f..a69d4a2f3a 100644
> --- a/libavformat/iamf_parse.c
> +++ b/libavformat/iamf_parse.c
> @@ -594,7 +594,7 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
>      FFIOContext b;
>      AVIOContext *pbc;
>      uint8_t *buf;
> -    unsigned audio_element_id, codec_config_id, num_parameters;
> +    unsigned audio_element_id, nb_substreams, codec_config_id, num_parameters;
>      int audio_element_type, ret;
> 
>      buf = av_malloc(len);
> @@ -649,14 +649,15 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
>          goto fail;
>      }
> 
> -    audio_element->nb_substreams = ffio_read_leb(pbc);
> +    nb_substreams = ffio_read_leb(pbc);
>      audio_element->codec_config_id = codec_config_id;
>      audio_element->audio_element_id = audio_element_id;
> -    audio_element->substreams = av_calloc(audio_element->nb_substreams, sizeof(*audio_element->substreams));
> +    audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams));
>      if (!audio_element->substreams) {
>          ret = AVERROR(ENOMEM);
>          goto fail;
>      }
> +    audio_element->nb_substreams = nb_substreams;
> 
>      element = audio_element->element = av_iamf_audio_element_alloc();
>      if (!element) {