提交 bafaf951 编写于 作者: M Michael Niedermayer

avcodec/wavpack: Do not allow the sample format to change between channels

Fixes: out of array access
Fixes: 22692/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5678686190960640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: NDavid Bryant <david@wavpack.com>
Tested-by: NDavid Bryant <david@wavpack.com>
Signed-off-by: NMichael Niedermayer <michael@niedermayer.cc>
上级 e34686d7
......@@ -1129,6 +1129,9 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
else
sample_fmt = AV_SAMPLE_FMT_S32P;
if (wc->ch_offset && avctx->sample_fmt != sample_fmt)
return AVERROR_INVALIDDATA;
bpp = av_get_bytes_per_sample(sample_fmt);
orig_bpp = ((s->frame_flags & 0x03) + 1) << 3;
multiblock = (s->frame_flags & WV_SINGLE_BLOCK) != WV_SINGLE_BLOCK;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册