PR #23277 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23277 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23277.patch
Fixes: 472641765/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6390897173659648 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From 3fc5d0b6035c4b7aef2ab55812f4613ff4ed6487 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 30 May 2026 04:19:41 +0200 Subject: [PATCH] avformat/iamf_parse: bound substream count by remaining OBU size Fixes: 472641765/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6390897173659648 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/iamf_parse.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 97a5c8a360..54aef4389b 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -816,6 +816,13 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) } nb_substreams = ffio_read_leb(pbc); + /* Each substream consumes at least one byte (its leb128 id) from the + * remaining OBU buffer, so a count larger than that cannot be valid and + * would only serve to force an oversized allocation. */ + if (nb_substreams > len - avio_tell(pbc)) { + ret = AVERROR_INVALIDDATA; + goto fail; + } audio_element->codec_config_id = codec_config_id; audio_element->audio_element_id = audio_element_id; audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams)); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
