On Thu, Sep 24, 2020 at 10:58:22PM +0200, Andreas Rheinhardt wrote: > Michael Niedermayer: > > Fixes: heap-buffer-overflow > > Fixes: > > 25744/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5172961169113088 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > > --- > > libavcodec/sonic.c | 11 +++++------ > > 1 file changed, 5 insertions(+), 6 deletions(-) > > > > diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c > > index fa4ecc3a7a..d09de6156b 100644 > > --- a/libavcodec/sonic.c > > +++ b/libavcodec/sonic.c > > @@ -980,12 +980,11 @@ static av_cold int sonic_decode_close(AVCodecContext > > *avctx) > > av_freep(&s->int_samples); > > av_freep(&s->tap_quant); > > av_freep(&s->predictor_k); > > - > > - for (i = 0; i < s->channels; i++) > > - { > > - av_freep(&s->predictor_state[i]); > > - av_freep(&s->coded_samples[i]); > > - } > > + if (s->channels <= MAX_CHANNELS) > > + for (i = 0; i < s->channels; i++) { > > + av_freep(&s->predictor_state[i]); > > + av_freep(&s->coded_samples[i]); > > + } > > > > return 0; > > } > >
> for (i = 0; i < MAX_CHANNELS; i++) would be simpler. ok will apply with that thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB "You are 36 times more likely to die in a bathtub than at the hands of a terrorist. Also, you are 2.5 times more likely to become a president and 2 times more likely to become an astronaut, than to die in a terrorist attack." -- Thoughty2
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
