This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg.
commit 5ed93579e7d242c5da00316397fc0499bb729598 Author: Michael Niedermayer <[email protected]> AuthorDate: Sat May 30 04:19:41 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 04:59:09 2026 +0200 avformat/iamf_parse: bound substream count by remaining OBU size also check for nb_substreams == 0 Fixes: 472641765/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6390897173659648 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit fe2dabbbf44184b6947d943aa5b4b1e82f7b3f3a) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/iamf_parse.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 5a1bfe4d52..29b8acd351 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -776,6 +776,13 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) } nb_substreams = ffio_read_leb(pbc); + /* Each substream consumes at least one byte (its leb128 id) from the + * remaining OBU buffer, so a count larger than that cannot be valid and + * would only serve to force an oversized allocation. */ + if (nb_substreams > len - avio_tell(pbc) || !nb_substreams) { + ret = AVERROR_INVALIDDATA; + goto fail; + } audio_element->codec_config_id = codec_config_id; audio_element->audio_element_id = audio_element_id; audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams)); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
