ffmpeg | branch: master | James Almer <jamr...@gmail.com> | Thu Feb 13 23:49:20 2025 -0300| [261ec6c35e306d0582f58b6842436839db837822] | committer: James Almer
avformat/mov: further ensure mov_build_index isn't run twice If sc->tts_count is not 0, then the sample index has already been built. Fixes: Null-dereference READ Fixes: 396192874/clusterfuzz-testcase-minimized-audio_decoder_fuzzer-4589309789143040 Signed-off-by: James Almer <jamr...@gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=261ec6c35e306d0582f58b6842436839db837822 --- libavformat/mov.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 85aef33b19..1c4b13864e 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -4688,7 +4688,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st) /* only use old uncompressed audio chunk demuxing when stts specifies it */ if (!(st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO && - sc->stts_count == 1 && sc->stts_data[0].duration == 1)) { + sc->stts_count == 1 && sc->stts_data && sc->stts_data[0].duration == 1)) { unsigned int current_sample = 0; unsigned int stts_sample = 0; unsigned int sample_size; @@ -4700,7 +4700,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st) current_dts -= sc->dts_shift; - if (!sc->sample_count || sti->nb_index_entries) + if (!sc->sample_count || sti->nb_index_entries || sc->tts_count) return; if (sc->sample_count >= UINT_MAX / sizeof(*sti->index_entries) - sti->nb_index_entries) return; @@ -4811,11 +4811,11 @@ static void mov_build_index(MOVContext *mov, AVStream *st) } else { unsigned chunk_samples, total = 0; - ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS); - if (ret < 0) + if (!sc->chunk_count || sc->tts_count) return; - if (!sc->chunk_count) + ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS); + if (ret < 0) return; // compute total chunk count _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
