[FFmpeg-devel] [PATCH] avformat/iamf_parse: ambisonics mode > 1 will crash

[James Almer]

On 11/29/2024 2:17 PM, Michael Niedermayer wrote:
> ambisonics mode > 1 does not initialize any layer but layer 0
> is unconditionally dereferenced
> 
> Fixes: poc-2024-11
> Fixes: null pointer dereference
> Found-by: 苏童 <220235212 at seu.edu.cn>
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>   libavformat/iamf_parse.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
> index 4aed894796f..1e1de167e6d 100644
> --- a/libavformat/iamf_parse.c
> +++ b/libavformat/iamf_parse.c
> @@ -413,7 +413,7 @@ static int ambisonics_config(void *s, AVIOContext *pb,
>   
>       ambisonics_mode = ffio_read_leb(pb);
>       if (ambisonics_mode > 1)
> -        return 0;
> +        return AVERROR_INVALIDDATA;
>   
>       output_channel_count = avio_r8(pb);  // C
>       substream_count = avio_r8(pb);  // N

Ok, but change the commit subject to something like "reject ambisonics 
mode > 1" or "abort on ambisonics mode > 1".

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20241130/7ffa0c00/attachment.sig>