This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new f8e6f8f0a2 avformat/iamf_parse: check layer channel count and stream
count for consistency
f8e6f8f0a2 is described below
commit f8e6f8f0a2dca947a91cd5fabcd2c51e27d29616
Author: James Almer <[email protected]>
AuthorDate: Fri Dec 26 20:37:19 2025 -0300
Commit: James Almer <[email protected]>
CommitDate: Sat Dec 27 15:16:49 2025 +0000
avformat/iamf_parse: check layer channel count and stream count for
consistency
A layer could define a loudspeaker_layout that corresponds to a certain
channel layout,
but then report an amount of substream_count and coupled_substream_count
that might not
match the expected channel count.
Fixes: Invalid write of size 4
Fixes:
clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6687125346254848
Signed-off-by: James Almer <[email protected]>
---
libavformat/iamf_parse.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 57ed89e74d..b9f24c0d6a 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -406,6 +406,7 @@ static int scalable_channel_layout_config(void *s,
AVIOContext *pb,
int substream_count, coupled_substream_count;
int expanded_loudspeaker_layout = -1;
int ret, byte = avio_r8(pb);
+ int channels;
layer = av_iamf_audio_element_add_layer(audio_element->element);
if (!layer)
@@ -455,7 +456,13 @@ static int scalable_channel_layout_config(void *s,
AVIOContext *pb,
.nb_channels =
substream_count +
coupled_substream_count };
- if (i && ch_layout.nb_channels <=
audio_element->element->layers[i-1]->ch_layout.nb_channels)
+ channels = ch_layout.nb_channels;
+ if (i) {
+ if (ch_layout.nb_channels <=
audio_element->element->layers[i-1]->ch_layout.nb_channels)
+ return AVERROR_INVALIDDATA;
+ channels -=
audio_element->element->layers[i-1]->ch_layout.nb_channels;
+ }
+ if (channels != substream_count + coupled_substream_count)
return AVERROR_INVALIDDATA;
for (int j = 0; j < substream_count; j++) {
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
