If sc->tts_count is not 0, then the sample index has already been built.
Fixes: Null-dereference READ
Fixes:
396192874/clusterfuzz-testcase-minimized-audio_decoder_fuzzer-4589309789143040
Signed-off-by: James Almer <jamr...@gmail.com>
---
Supersedes "avformat/mov: ensure no trun atoms are parsed as children of trak"
libavformat/mov.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 85aef33b19..1c4b13864e 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4688,7 +4688,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
/* only use old uncompressed audio chunk demuxing when stts specifies it */
if (!(st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO &&
- sc->stts_count == 1 && sc->stts_data[0].duration == 1)) {
+ sc->stts_count == 1 && sc->stts_data && sc->stts_data[0].duration ==
1)) {
unsigned int current_sample = 0;
unsigned int stts_sample = 0;
unsigned int sample_size;
@@ -4700,7 +4700,7 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
current_dts -= sc->dts_shift;
- if (!sc->sample_count || sti->nb_index_entries)
+ if (!sc->sample_count || sti->nb_index_entries || sc->tts_count)
return;
if (sc->sample_count >= UINT_MAX / sizeof(*sti->index_entries) -
sti->nb_index_entries)
return;
@@ -4811,11 +4811,11 @@ static void mov_build_index(MOVContext *mov, AVStream
*st)
} else {
unsigned chunk_samples, total = 0;
- ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS);
- if (ret < 0)
+ if (!sc->chunk_count || sc->tts_count)
return;
- if (!sc->chunk_count)
+ ret = mov_merge_tts_data(mov, st, MOV_MERGE_CTTS);
+ if (ret < 0)
return;
// compute total chunk count
--
2.48.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
