ffmpeg | branch: master | Lynne <d...@lynne.ee> | Sun Jun 2 23:45:31 2024 +0200| [2554c5e39ede9e5f764bdbb47e506bd533995c73] | committer: Lynne
aacdec_usac: error out on too many elements USAC supports up to 64 audio channels, but puts no limit on the total number of extensions that may be present. Which may mean that there's a single audio channel, with 65 thousand extension elements. We assume that 64 elements is the maximum for now. So check the value. > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2554c5e39ede9e5f764bdbb47e506bd533995c73 --- libavcodec/aac/aacdec_usac.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c index 19390ad794..99f598b2ad 100644 --- a/libavcodec/aac/aacdec_usac.c +++ b/libavcodec/aac/aacdec_usac.c @@ -393,6 +393,11 @@ int ff_aac_usac_config_decode(AACDecContext *ac, AVCodecContext *avctx, /* UsacDecoderConfig */ elem_id[0] = elem_id[1] = elem_id[2] = 0; usac->nb_elems = get_escaped_value(gb, 4, 8, 16) + 1; + if (usac->nb_elems > 64) { + av_log(ac->avctx, AV_LOG_ERROR, "Too many elements: %i\n", + usac->nb_elems); + return AVERROR(EINVAL); + } for (int i = 0; i < usac->nb_elems; i++) { AACUsacElemConfig *e = &usac->elems[i]; _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
