From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <ffmpeg-devel-bounces@ffmpeg.org> Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 7578749820 for <ffmpegdev@gitmailbox.com>; Thu, 21 Mar 2024 02:17:03 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id DB10468D517; Thu, 21 Mar 2024 04:17:00 +0200 (EET) Received: from mail-oi1-f181.google.com (mail-oi1-f181.google.com [209.85.167.181]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 4EC6568D4FC for <ffmpeg-devel@ffmpeg.org>; Thu, 21 Mar 2024 04:16:54 +0200 (EET) Received: by mail-oi1-f181.google.com with SMTP id 5614622812f47-3c3775ce48fso353257b6e.2 for <ffmpeg-devel@ffmpeg.org>; Wed, 20 Mar 2024 19:16:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1710987411; x=1711592211; darn=ffmpeg.org; h=content-transfer-encoding:in-reply-to:from:references:to :content-language:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=aUAu0jyVymou7q62ivkLLOtA9CwVEa4vhJBbI/n462c=; b=HWKCFM6wlUUqGjNFYCiyuXJzxZXKvOLjj7z6nqvydV/mPwao2ACgtEPzI8K6hTSGNm savLY7w/R05VgIZxvoNHouNLDngma1hpsSCzeYJR1daPytfSeb7HIb3L+VqFgXIhcwVF XvjMq4weqA0gMufTgvNRHtIhNmShIElsR4spL1irfGxbAxR4xSyDLTv4ZE6qNfhNhp1B C1gA5Pduq3xJAETelI13e5kddnmyw3BtpLzELfFudomzET+XLKaESu/RUXJ7o3epo7p4 N579dDx05EDcoJofUZIRtFEFp6mmyL3N47z43W9e8zzDxND2wP3SNGvc1/eqoTBL9hv1 Ox0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710987411; x=1711592211; h=content-transfer-encoding:in-reply-to:from:references:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=aUAu0jyVymou7q62ivkLLOtA9CwVEa4vhJBbI/n462c=; b=tuaMzIbrR8hbrnVlVtYrzxGUKI3oAOD36SUCiYzfjbg2OSrVLoZyLml6aaAlRvuo2j POVT94gdvEBJQJMOY0UDZFA0p7NkvMuozA1tJAQ7OCJwxIoZPwQ2WRwwm+vF3jXv7LJ5 7EvOnc+EHztT4lXd2y4QhbK+O8cQ/ItC8hxrOCtdkpoqcgb7i3OOjlwgZ0Vk9imQ0z9H ZZST2Gi4FFH6bErVtUISZAl+KxDODGDGuHBkSUj4ovsCyF/q0yz5WtBSmYMCiFvYgTc2 M0xmHzrEq/HcrT5tAmnFLxVEXl5gGFgpsNynCmB3TmelU9T7eIf0QF6dN+hsZbhKtlg1 +rdw== X-Gm-Message-State: AOJu0YxlWNQD+U2j6jdoPoTvH41llm5QkIuxOE7RhYWcWtOFCCGyMcNe +ruKNwBbq4pJLb42o1UUNmCVd6QHfUu7AYQjNljyLCulp1VVlb9VTZVKrvUD X-Google-Smtp-Source: AGHT+IHnlW7xBpefXVCIRTntS82RIq5JZ9frU9cVK7ljFQUsOyWsRTx8Fe0lcaicscZTEOMDXnyNRw== X-Received: by 2002:a05:6808:23ce:b0:3c3:7e7a:b5d3 with SMTP id bq14-20020a05680823ce00b003c37e7ab5d3mr1027813oib.42.1710987410892; Wed, 20 Mar 2024 19:16:50 -0700 (PDT) Received: from [192.168.0.10] ([190.194.167.233]) by smtp.gmail.com with ESMTPSA id z7-20020aa79e47000000b006e510c61d49sm12368706pfq.183.2024.03.20.19.16.49 for <ffmpeg-devel@ffmpeg.org> (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 20 Mar 2024 19:16:50 -0700 (PDT) Message-ID: <00907e21-57ef-4c45-836b-0535c3755cd0@gmail.com> Date: Wed, 20 Mar 2024 23:17:09 -0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: ffmpeg-devel@ffmpeg.org References: <20240321011517.10363-1-michael@niedermayer.cc> <20240321011517.10363-4-michael@niedermayer.cc> From: James Almer <jamrial@gmail.com> In-Reply-To: <20240321011517.10363-4-michael@niedermayer.cc> Subject: Re: [FFmpeg-devel] [PATCH 4/4] avformat/iamf: Check language_label X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches <ffmpeg-devel.ffmpeg.org> List-Unsubscribe: <https://ffmpeg.org/mailman/options/ffmpeg-devel>, <mailto:ffmpeg-devel-request@ffmpeg.org?subject=unsubscribe> List-Archive: <https://ffmpeg.org/pipermail/ffmpeg-devel> List-Post: <mailto:ffmpeg-devel@ffmpeg.org> List-Help: <mailto:ffmpeg-devel-request@ffmpeg.org?subject=help> List-Subscribe: <https://ffmpeg.org/mailman/listinfo/ffmpeg-devel>, <mailto:ffmpeg-devel-request@ffmpeg.org?subject=subscribe> Reply-To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org> Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" <ffmpeg-devel-bounces@ffmpeg.org> Archived-At: <https://master.gitmailbox.com/ffmpegdev/00907e21-57ef-4c45-836b-0535c3755cd0@gmail.com/> List-Archive: <https://master.gitmailbox.com/ffmpegdev/> List-Post: <mailto:ffmpegdev@gitmailbox.com> On 3/20/2024 10:15 PM, Michael Niedermayer wrote: > Fixes: null pointer dereference > Fixes: 67023/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6011025237278720 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/iamf.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/libavformat/iamf.c b/libavformat/iamf.c > index 5de70dc082..f2c22ce3aa 100644 > --- a/libavformat/iamf.c > +++ b/libavformat/iamf.c > @@ -89,9 +89,10 @@ void ff_iamf_free_mix_presentation(IAMFMixPresentation **pmix_presentation) > if (!mix_presentation) > return; > > - for (int i = 0; i < mix_presentation->count_label; i++) > - av_free(mix_presentation->language_label[i]); > - av_free(mix_presentation->language_label); > + if (mix_presentation->language_label) If count_label is not 0, then language_label should be allocated. > + for (int i = 0; i < mix_presentation->count_label; i++) > + av_free(mix_presentation->language_label[i]); > + av_freep(&mix_presentation->language_label); > av_iamf_mix_presentation_free(&mix_presentation->mix); > av_freep(pmix_presentation); > } Can you test the following? > diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c > index cb49cf0a57..e29c2c6b6c 100644 > --- a/libavformat/iamf_parse.c > +++ b/libavformat/iamf_parse.c > @@ -822,6 +822,7 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le > mix_presentation->language_label = av_calloc(mix_presentation->count_label, > sizeof(*mix_presentation->language_label)); > if (!mix_presentation->language_label) { > + mix_presentation->count_label = 0; > ret = AVERROR(ENOMEM); > goto fail; > } _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".