PR #21300 opened by James Almer (jamrial) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21300 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21300.patch
A layer could define a loudspeaker_layout that corresponds to a certain channel layout, but then report an amount of substream_count and coupled_substream_count that might not match the expected channel count. Fixes: Invalid write of size 4 Fixes: clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6687125346254848 >From 0dd2c3a7ff3bba3154e64b9dacd12be3fc8432f9 Mon Sep 17 00:00:00 2001 From: James Almer <[email protected]> Date: Fri, 26 Dec 2025 20:37:19 -0300 Subject: [PATCH] avformat/iamf_parse: check layer channel count and stream count for consistency A layer could define a loudspeaker_layout that corresponds to a certain channel layout, but then report an amount of substream_count and coupled_substream_count that might not match the expected channel count. Fixes: Invalid write of size 4 Fixes: clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6687125346254848 Signed-off-by: James Almer <[email protected]> --- libavformat/iamf_parse.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 57ed89e74d..b9f24c0d6a 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -406,6 +406,7 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb, int substream_count, coupled_substream_count; int expanded_loudspeaker_layout = -1; int ret, byte = avio_r8(pb); + int channels; layer = av_iamf_audio_element_add_layer(audio_element->element); if (!layer) @@ -455,7 +456,13 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb, .nb_channels = substream_count + coupled_substream_count }; - if (i && ch_layout.nb_channels <= audio_element->element->layers[i-1]->ch_layout.nb_channels) + channels = ch_layout.nb_channels; + if (i) { + if (ch_layout.nb_channels <= audio_element->element->layers[i-1]->ch_layout.nb_channels) + return AVERROR_INVALIDDATA; + channels -= audio_element->element->layers[i-1]->ch_layout.nb_channels; + } + if (channels != substream_count + coupled_substream_count) return AVERROR_INVALIDDATA; for (int j = 0; j < substream_count; j++) { -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
