This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new fe2dabbbf4 avformat/iamf_parse: bound substream count by remaining OBU
size
fe2dabbbf4 is described below
commit fe2dabbbf44184b6947d943aa5b4b1e82f7b3f3a
Author: Michael Niedermayer <[email protected]>
AuthorDate: Sat May 30 04:19:41 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Fri Jun 5 01:11:58 2026 +0000
avformat/iamf_parse: bound substream count by remaining OBU size
also check for nb_substreams == 0
Fixes:
472641765/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6390897173659648
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/iamf_parse.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 97a5c8a360..d74a8677d6 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -816,6 +816,13 @@ static int audio_element_obu(void *s, IAMFContext *c,
AVIOContext *pb, int len)
}
nb_substreams = ffio_read_leb(pbc);
+ /* Each substream consumes at least one byte (its leb128 id) from the
+ * remaining OBU buffer, so a count larger than that cannot be valid and
+ * would only serve to force an oversized allocation. */
+ if (nb_substreams > len - avio_tell(pbc) || !nb_substreams) {
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
audio_element->codec_config_id = codec_config_id;
audio_element->audio_element_id = audio_element_id;
audio_element->substreams = av_calloc(nb_substreams,
sizeof(*audio_element->substreams));
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
