From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 8C8744C826 for ; Sun, 9 Feb 2025 02:24:55 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 9824468BCAB; Sun, 9 Feb 2025 04:24:34 +0200 (EET) Received: from relay4-d.mail.gandi.net (relay4-d.mail.gandi.net [217.70.183.196]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 9B96F68BA9C for ; Sun, 9 Feb 2025 04:24:25 +0200 (EET) Received: by mail.gandi.net (Postfix) with ESMTPSA id D4FD1443D7 for ; Sun, 9 Feb 2025 02:24:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1739067865; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RBZJ3OJxDDCE21eaxkKvL3o8+/7UCq869d5OoL+a408=; b=oCvagCswDpg01F4dPKDKGjaWLoFkEy5SnENsPSUAFFGpfgVGV4VBBVdN2zan+O/BrP0Et0 +ikmoZ879zgr1h86uvsxRpzgBAHuoVCfjApk/H815VI+pTHUBCmvE3DaR6PquF07ssr51b FG3zhZIJTl0GL1SprEnFjJD80S10EcJoltVq/SJA2ZSITGQx6j4OwyfK9R9OwLjQyzxjKx pjlxHb6uhiSsCSGA0wZMroYdWfMx5FIeQLrrnvL4N1PH6F9pl4tvnMlNlHn9paCwL8nFaC szdwjjhDOVrE4aI5VDVGYkwXADKlM0Mz0S3wcZjIHRS6ojDf3Ay7LWunv/KiSg== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Sun, 9 Feb 2025 03:24:18 +0100 Message-ID: <20250209022421.2346210-3-michael@niedermayer.cc> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250209022421.2346210-1-michael@niedermayer.cc> References: <20250209022421.2346210-1-michael@niedermayer.cc> MIME-Version: 1.0 X-GND-State: clean X-GND-Score: -85 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdeffeeltdcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfitefpfffkpdcuggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnegfrhhlucfvnfffucdludehmdenucfjughrpefhvffufffkofgjfhgggfestdekredtredttdenucfhrhhomhepofhitghhrggvlhcupfhivgguvghrmhgrhigvrhcuoehmihgthhgrvghlsehnihgvuggvrhhmrgihvghrrdgttgeqnecuggftrfgrthhtvghrnhepgeejhfetgefhgfeludegvdduvdffgeefvddtheetlefhueeitdevffevfeehhefgnecuffhomhgrihhnpehgihhthhhusgdrtghomhenucfkphepgedurdeiiedrieejrdduudefnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepgedurdeiiedrieejrdduudefpdhhvghloheplhhotggrlhhhohhsthdpmhgrihhlfhhrohhmpehmihgthhgrvghlsehnihgvuggvrhhmrgihvghrrdgttgdpnhgspghrtghpthhtohepuddprhgtphhtthhopehffhhmphgvghdquggvvhgvlhesfhhfmhhpvghgrdhorhhg X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 3/6] avcodec/aac/aacdec_usac: Fix memory deallocation of pl_data X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: Fixes: double free Fixes: 393523547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-6740617236905984 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/aac/aacdec.c | 19 +++++++++++++++++-- libavcodec/aac/aacdec_usac.c | 3 ++- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c index 8d50ad6d095..16259b5ada9 100644 --- a/libavcodec/aac/aacdec.c +++ b/libavcodec/aac/aacdec.c @@ -421,6 +421,21 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags) return layout; } +static void copy_oc(OutputConfiguration *dst, OutputConfiguration *src) +{ + int err = 0; + + for(int i = 0; i < dst->usac.nb_elems; i++) + av_freep(&dst->usac.elems[i].ext.pl_data); + + *dst = *src; + + for(int i = 0; i < dst->usac.nb_elems; i++) { + AACUsacElemConfig *e = &dst->usac.elems[i]; + e->ext.pl_data = av_memdup(e->ext.pl_data, e->ext.pl_data_offset); + } +} + /** * Save current output configuration if and only if it has been locked. */ @@ -429,7 +444,7 @@ static int push_output_configuration(AACDecContext *ac) int pushed = 0; if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) { - ac->oc[0] = ac->oc[1]; + copy_oc(&ac->oc[0], &ac->oc[1]); pushed = 1; } ac->oc[1].status = OC_NONE; @@ -443,7 +458,7 @@ static int push_output_configuration(AACDecContext *ac) static void pop_output_configuration(AACDecContext *ac) { if (ac->oc[1].status != OC_LOCKED && ac->oc[0].status != OC_NONE) { - ac->oc[1] = ac->oc[0]; + copy_oc(&ac->oc[1], &ac->oc[0]); ac->avctx->ch_layout = ac->oc[1].ch_layout; ff_aac_output_configure(ac, ac->oc[1].layout_map, ac->oc[1].layout_map_tags, ac->oc[1].status, 0); diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c index ccdf58bc8e2..e6f86b4a677 100644 --- a/libavcodec/aac/aacdec_usac.c +++ b/libavcodec/aac/aacdec_usac.c @@ -1604,7 +1604,8 @@ static int parse_ext_ele(AACDecContext *ac, AACUsacElemConfig *e, if (!(pl_frag_start && pl_frag_end)) { tmp = av_realloc(e->ext.pl_data, e->ext.pl_data_offset + len); if (!tmp) { - av_free(e->ext.pl_data); + av_freep(&e->ext.pl_data); + e->ext.pl_data_offset = 0; return AVERROR(ENOMEM); } e->ext.pl_data = tmp; -- 2.48.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".