[FFmpeg-devel] [PATCH] aacdec: set ac->output_elements upon channel element free

[FFmpeg-devel] [PATCH] aacdec: set ac->output_elements upon channel element free

[Lynne via ffmpeg-devel]

The issue is that ac->output_elements is populated from
ac->che, which may be freed, leaving dangling pointers in this
list.

Should fix clusterfuzz.
---
 libavcodec/aac/aacdec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index ea2ba84a80..c37de2e003 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -166,6 +166,7 @@ static av_cold int che_configure(AACDecContext *ac,
             ac->proc.sbr_ctx_close(ac->che[type][id]);
         }
         av_freep(&ac->che[type][id]);
+        memset(ac->output_element, 0, sizeof(ac->output_element));
     }
     return 0;
 }
-- 
2.45.2.753.g447d99e1c3b
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] aacdec: set ac->output_elements upon channel element free

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 638 bytes --]

On Mon, Jul 22, 2024 at 03:22:31AM +0200, Lynne via ffmpeg-devel wrote:
> The issue is that ac->output_elements is populated from
> ac->che, which may be freed, leaving dangling pointers in this
> list.
> 
> Should fix clusterfuzz.
> ---
>  libavcodec/aac/aacdec.c | 1 +
>  1 file changed, 1 insertion(+)

thanks!

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

When the tyrant has disposed of foreign enemies by conquest or treaty, and
there is nothing more to fear from them, then he is always stirring up
some war or other, in order that the people may require a leader. -- Plato

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".