From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <ffmpeg-devel-bounces@ffmpeg.org>
Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100])
	by master.gitmailbox.com (Postfix) with ESMTP id 7578749820
	for <ffmpegdev@gitmailbox.com>; Thu, 21 Mar 2024 02:17:03 +0000 (UTC)
Received: from [127.0.1.1] (localhost [127.0.0.1])
	by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id DB10468D517;
	Thu, 21 Mar 2024 04:17:00 +0200 (EET)
Received: from mail-oi1-f181.google.com (mail-oi1-f181.google.com
 [209.85.167.181])
 by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 4EC6568D4FC
 for <ffmpeg-devel@ffmpeg.org>; Thu, 21 Mar 2024 04:16:54 +0200 (EET)
Received: by mail-oi1-f181.google.com with SMTP id
 5614622812f47-3c3775ce48fso353257b6e.2
 for <ffmpeg-devel@ffmpeg.org>; Wed, 20 Mar 2024 19:16:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1710987411; x=1711592211; darn=ffmpeg.org;
 h=content-transfer-encoding:in-reply-to:from:references:to
 :content-language:subject:user-agent:mime-version:date:message-id
 :from:to:cc:subject:date:message-id:reply-to;
 bh=aUAu0jyVymou7q62ivkLLOtA9CwVEa4vhJBbI/n462c=;
 b=HWKCFM6wlUUqGjNFYCiyuXJzxZXKvOLjj7z6nqvydV/mPwao2ACgtEPzI8K6hTSGNm
 savLY7w/R05VgIZxvoNHouNLDngma1hpsSCzeYJR1daPytfSeb7HIb3L+VqFgXIhcwVF
 XvjMq4weqA0gMufTgvNRHtIhNmShIElsR4spL1irfGxbAxR4xSyDLTv4ZE6qNfhNhp1B
 C1gA5Pduq3xJAETelI13e5kddnmyw3BtpLzELfFudomzET+XLKaESu/RUXJ7o3epo7p4
 N579dDx05EDcoJofUZIRtFEFp6mmyL3N47z43W9e8zzDxND2wP3SNGvc1/eqoTBL9hv1
 Ox0g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1710987411; x=1711592211;
 h=content-transfer-encoding:in-reply-to:from:references:to
 :content-language:subject:user-agent:mime-version:date:message-id
 :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
 bh=aUAu0jyVymou7q62ivkLLOtA9CwVEa4vhJBbI/n462c=;
 b=tuaMzIbrR8hbrnVlVtYrzxGUKI3oAOD36SUCiYzfjbg2OSrVLoZyLml6aaAlRvuo2j
 POVT94gdvEBJQJMOY0UDZFA0p7NkvMuozA1tJAQ7OCJwxIoZPwQ2WRwwm+vF3jXv7LJ5
 7EvOnc+EHztT4lXd2y4QhbK+O8cQ/ItC8hxrOCtdkpoqcgb7i3OOjlwgZ0Vk9imQ0z9H
 ZZST2Gi4FFH6bErVtUISZAl+KxDODGDGuHBkSUj4ovsCyF/q0yz5WtBSmYMCiFvYgTc2
 M0xmHzrEq/HcrT5tAmnFLxVEXl5gGFgpsNynCmB3TmelU9T7eIf0QF6dN+hsZbhKtlg1
 +rdw==
X-Gm-Message-State: AOJu0YxlWNQD+U2j6jdoPoTvH41llm5QkIuxOE7RhYWcWtOFCCGyMcNe
 +ruKNwBbq4pJLb42o1UUNmCVd6QHfUu7AYQjNljyLCulp1VVlb9VTZVKrvUD
X-Google-Smtp-Source: AGHT+IHnlW7xBpefXVCIRTntS82RIq5JZ9frU9cVK7ljFQUsOyWsRTx8Fe0lcaicscZTEOMDXnyNRw==
X-Received: by 2002:a05:6808:23ce:b0:3c3:7e7a:b5d3 with SMTP id
 bq14-20020a05680823ce00b003c37e7ab5d3mr1027813oib.42.1710987410892; 
 Wed, 20 Mar 2024 19:16:50 -0700 (PDT)
Received: from [192.168.0.10] ([190.194.167.233])
 by smtp.gmail.com with ESMTPSA id
 z7-20020aa79e47000000b006e510c61d49sm12368706pfq.183.2024.03.20.19.16.49
 for <ffmpeg-devel@ffmpeg.org>
 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
 Wed, 20 Mar 2024 19:16:50 -0700 (PDT)
Message-ID: <00907e21-57ef-4c45-836b-0535c3755cd0@gmail.com>
Date: Wed, 20 Mar 2024 23:17:09 -0300
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: ffmpeg-devel@ffmpeg.org
References: <20240321011517.10363-1-michael@niedermayer.cc>
 <20240321011517.10363-4-michael@niedermayer.cc>
From: James Almer <jamrial@gmail.com>
In-Reply-To: <20240321011517.10363-4-michael@niedermayer.cc>
Subject: Re: [FFmpeg-devel] [PATCH 4/4] avformat/iamf: Check language_label
X-BeenThere: ffmpeg-devel@ffmpeg.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: FFmpeg development discussions and patches <ffmpeg-devel.ffmpeg.org>
List-Unsubscribe: <https://ffmpeg.org/mailman/options/ffmpeg-devel>,
 <mailto:ffmpeg-devel-request@ffmpeg.org?subject=unsubscribe>
List-Archive: <https://ffmpeg.org/pipermail/ffmpeg-devel>
List-Post: <mailto:ffmpeg-devel@ffmpeg.org>
List-Help: <mailto:ffmpeg-devel-request@ffmpeg.org?subject=help>
List-Subscribe: <https://ffmpeg.org/mailman/listinfo/ffmpeg-devel>,
 <mailto:ffmpeg-devel-request@ffmpeg.org?subject=subscribe>
Reply-To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: ffmpeg-devel-bounces@ffmpeg.org
Sender: "ffmpeg-devel" <ffmpeg-devel-bounces@ffmpeg.org>
Archived-At: <https://master.gitmailbox.com/ffmpegdev/00907e21-57ef-4c45-836b-0535c3755cd0@gmail.com/>
List-Archive: <https://master.gitmailbox.com/ffmpegdev/>
List-Post: <mailto:ffmpegdev@gitmailbox.com>

On 3/20/2024 10:15 PM, Michael Niedermayer wrote:
> Fixes: null pointer dereference
> Fixes: 67023/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6011025237278720
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>   libavformat/iamf.c | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/libavformat/iamf.c b/libavformat/iamf.c
> index 5de70dc082..f2c22ce3aa 100644
> --- a/libavformat/iamf.c
> +++ b/libavformat/iamf.c
> @@ -89,9 +89,10 @@ void ff_iamf_free_mix_presentation(IAMFMixPresentation **pmix_presentation)
>       if (!mix_presentation)
>           return;
>   
> -    for (int i = 0; i < mix_presentation->count_label; i++)
> -        av_free(mix_presentation->language_label[i]);
> -    av_free(mix_presentation->language_label);
> +    if (mix_presentation->language_label)

If count_label is not 0, then language_label should be allocated.

> +        for (int i = 0; i < mix_presentation->count_label; i++)
> +            av_free(mix_presentation->language_label[i]);
> +    av_freep(&mix_presentation->language_label);
>       av_iamf_mix_presentation_free(&mix_presentation->mix);
>       av_freep(pmix_presentation);
>   }

Can you test the following?

> diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
> index cb49cf0a57..e29c2c6b6c 100644
> --- a/libavformat/iamf_parse.c
> +++ b/libavformat/iamf_parse.c
> @@ -822,6 +822,7 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le
>      mix_presentation->language_label = av_calloc(mix_presentation->count_label,
>                                                   sizeof(*mix_presentation->language_label));
>      if (!mix_presentation->language_label) {
> +        mix_presentation->count_label = 0;
>          ret = AVERROR(ENOMEM);
>          goto fail;
>      }

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".