Fixes: index 32 out of bounds for type 'int [32]'
Fixes:
18350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3P_fuzzer-5643794862571520
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
libavcodec/atrac3plus.c | 4
1 file changed, 4 insertions(+)
diff --git a/libavcodec/atrac3plus.c b/libavcodec/atrac3plus.c
index 9f964efb4d..8d17889582 100644
--- a/libavcodec/atrac3plus.c
+++ b/libavcodec/atrac3plus.c
@@ -456,6 +456,10 @@ static int decode_channel_wordlen(GetBitContext *gb,
Atrac3pChanUnitCtx *ctx,
} else if (chan->fill_mode == 3) {
pos = ch_num ? chan->num_coded_vals + chan->split_point
: ctx->num_quant_units - chan->split_point;
+if (pos > FF_ARRAY_ELEMS(chan->qu_wordlen)) {
+av_log(avctx, AV_LOG_ERROR, "Split point beyond array\n");
+pos = FF_ARRAY_ELEMS(chan->qu_wordlen);
+}
for (i = chan->num_coded_vals; i < pos; i++)
chan->qu_wordlen[i] = 1;
}
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".