[FFmpeg-devel] [PATCH] avformat/iamf_parse: check layer channel count and stream count for consistency (PR #21300)

[James Almer via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21300 opened by James Almer (jamrial)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21300
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21300.patch

A layer could define a loudspeaker_layout that corresponds to a certain channel layout, but then report an amount of substream_count and coupled_substream_count that might not match the expected channel count.

Fixes: Invalid write of size 4
Fixes: clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6687125346254848


>From 0dd2c3a7ff3bba3154e64b9dacd12be3fc8432f9 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 26 Dec 2025 20:37:19 -0300
Subject: [PATCH] avformat/iamf_parse: check layer channel count and stream
 count for consistency

A layer could define a loudspeaker_layout that corresponds to a certain channel layout,
but then report an amount of substream_count and coupled_substream_count that might not
match the expected channel count.

Fixes: Invalid write of size 4
Fixes: clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6687125346254848

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavformat/iamf_parse.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 57ed89e74d..b9f24c0d6a 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -406,6 +406,7 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb,
         int substream_count, coupled_substream_count;
         int expanded_loudspeaker_layout = -1;
         int ret, byte = avio_r8(pb);
+        int channels;
 
         layer = av_iamf_audio_element_add_layer(audio_element->element);
         if (!layer)
@@ -455,7 +456,13 @@ static int scalable_channel_layout_config(void *s, AVIOContext *pb,
                                                           .nb_channels = substream_count +
                                                                          coupled_substream_count };
 
-        if (i && ch_layout.nb_channels <= audio_element->element->layers[i-1]->ch_layout.nb_channels)
+        channels = ch_layout.nb_channels;
+        if (i) {
+            if (ch_layout.nb_channels <= audio_element->element->layers[i-1]->ch_layout.nb_channels)
+                return AVERROR_INVALIDDATA;
+            channels -= audio_element->element->layers[i-1]->ch_layout.nb_channels;
+        }
+        if (channels != substream_count + coupled_substream_count)
             return AVERROR_INVALIDDATA;
 
         for (int j = 0; j < substream_count; j++) {
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org