[FFmpeg-devel] [PR] avcodec/adpcm: handle ADPCM_IMA_MAGIX like other similar codecs (PR #21682)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21682 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21682
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21682.patch

Fixes: out of array access
Fixes: 471509958/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_MAGIX_DEC_fuzzer-4847227777646592

We ask for a mono sample because the implementation for mono is incomplete

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From 8a8c4b9ec301dcfd626f41bd567b8f0336062dc1 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 8 Feb 2026 01:28:16 +0100
Subject: [PATCH] avcodec/adpcm: handle ADPCM_IMA_MAGIX like other similar
 codecs

Fixes: out of array access
Fixes: 471509958/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_MAGIX_DEC_fuzzer-4847227777646592

We ask for a mono sample because the implementation for mono is incomplete

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/adpcm.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index 31340af677..380e4a5df5 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -1216,7 +1216,6 @@ static int get_nb_samples(AVCodecContext *avctx, GetByteContext *gb,
         case AV_CODEC_ID_ADPCM_AGM:
         case AV_CODEC_ID_ADPCM_IMA_ACORN:
         case AV_CODEC_ID_ADPCM_IMA_DAT4:
-        case AV_CODEC_ID_ADPCM_IMA_MAGIX:
         case AV_CODEC_ID_ADPCM_IMA_MOFLEX:
         case AV_CODEC_ID_ADPCM_IMA_ISS:     header_size = 4 * ch;      break;
         case AV_CODEC_ID_ADPCM_IMA_SMJPEG:  header_size = 4 * ch;      break;
@@ -1313,6 +1312,15 @@ static int get_nb_samples(AVCodecContext *avctx, GetByteContext *gb,
             buf_size = FFMIN(buf_size, avctx->block_align);
         nb_samples = (buf_size - 4 * ch) * 2 / ch;
         break;
+    case AV_CODEC_ID_ADPCM_IMA_MAGIX:
+        if (avctx->block_align > 0)
+            buf_size = FFMIN(buf_size, avctx->block_align);
+        nb_samples = (buf_size - 4 * ch) * 2 / ch;
+        if (ch == 1) {
+            avpriv_request_sample(avctx, "mono ADPCM Magix");
+            return AVERROR_PATCHWELCOME;
+        }
+        break;
     CASE(ADPCM_IMA_WAV,
         int bsize = ff_adpcm_ima_block_sizes[avctx->bits_per_coded_sample - 2];
         int bsamples = ff_adpcm_ima_block_samples[avctx->bits_per_coded_sample - 2];
@@ -1797,7 +1805,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, AVFrame *frame,
             }
         }
 
-        for (int m = 0; m < avctx->block_align-8; m += 8) {
+        for (int m = 0; m < channels*nb_samples/16; m ++) {
             uint32_t v0 = bytestream2_get_le32u(&gb);
             uint32_t v1 = bytestream2_get_le32u(&gb);
 
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org