ffmpeg | branch: master | Michael Niedermayer <[email protected]> | Wed 
Sep  9 23:13:02 2020 +0200| [81503ac58a763a36b1f57264013b1e76acb62b68] | 
committer: Michael Niedermayer

avcodec/utils: Require a non zero channels unless AV_CODEC_CAP_CHANNEL_CONF is 
set

This avoids per codec checks for channels not being 0

Fixes: division by 0
Fixes: 
25419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FASTAUDIO_fuzzer-5632544761184256
Fixes: 
25433/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FASTAUDIO_fuzzer-6215671900536832

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Paul B Mahol <[email protected]>
See: [FFmpeg-devel] [PATCH 1/3] avcodec/fastaudio: Check channel
Reviewed-by: Paul B Mahol <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=81503ac58a763a36b1f57264013b1e76acb62b68
---

 libavcodec/utils.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index 3232a242c0..45295dd3ce 100644
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -667,6 +667,15 @@ int attribute_align_arg avcodec_open2(AVCodecContext 
*avctx, const AVCodec *code
         ret = AVERROR(EINVAL);
         goto free_and_end;
     }
+    if (av_codec_is_decoder(codec) &&
+        codec->type == AVMEDIA_TYPE_AUDIO &&
+        !(codec->capabilities & AV_CODEC_CAP_CHANNEL_CONF) &&
+        avctx->channels == 0) {
+        av_log(avctx, AV_LOG_ERROR, "Decoder requires channel count but 
channels not set\n");
+        ret = AVERROR(EINVAL);
+        goto free_and_end;
+    }
+
     if (avctx->sample_rate < 0) {
         av_log(avctx, AV_LOG_ERROR, "Invalid sample rate: %d\n", 
avctx->sample_rate);
         ret = AVERROR(EINVAL);

_______________________________________________
ffmpeg-cvslog mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".

Reply via email to