Browse Source

avcodec/aacdec_template: Fix running cleanup in decode_ics_info()

Fixes: out of array read
Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Previous version reviewed-by: Alex Converse <alex.converse@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f03ffb47d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
tags/n2.4.14
Michael Niedermayer 8 years ago
parent
commit
ba4b4e4809
1 changed files with 9 additions and 4 deletions
  1. +9
    -4
      libavcodec/aacdec.c

+ 9
- 4
libavcodec/aacdec.c View File

@@ -1206,6 +1206,8 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
GetBitContext *gb)
{
int aot = ac->oc[1].m4ac.object_type;
int ret_fail = AVERROR_INVALIDDATA;

if (aot != AOT_ER_AAC_ELD) {
if (get_bits1(gb)) {
av_log(ac->avctx, AV_LOG_ERROR, "Reserved bit set.\n");
@@ -1249,8 +1251,10 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
ics->swb_offset = ff_swb_offset_512[ac->oc[1].m4ac.sampling_index];
ics->num_swb = ff_aac_num_swb_512[ac->oc[1].m4ac.sampling_index];
ics->tns_max_bands = ff_tns_max_bands_512[ac->oc[1].m4ac.sampling_index];
if (!ics->num_swb || !ics->swb_offset)
return AVERROR_BUG;
if (!ics->num_swb || !ics->swb_offset) {
ret_fail = AVERROR_BUG;
goto fail;
}
} else {
ics->swb_offset = ff_swb_offset_1024[ac->oc[1].m4ac.sampling_index];
ics->num_swb = ff_aac_num_swb_1024[ac->oc[1].m4ac.sampling_index];
@@ -1274,7 +1278,8 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
if (aot == AOT_ER_AAC_LD) {
av_log(ac->avctx, AV_LOG_ERROR,
"LTP in ER AAC LD not yet implemented.\n");
return AVERROR_PATCHWELCOME;
ret_fail = AVERROR_PATCHWELCOME;
goto fail;
}
if ((ics->ltp.present = get_bits(gb, 1)))
decode_ltp(&ics->ltp, gb, ics->max_sfb);
@@ -1293,7 +1298,7 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
return 0;
fail:
ics->max_sfb = 0;
return AVERROR_INVALIDDATA;
return ret_fail;
}

/**


Loading…
Cancel
Save