From 4485a0fd77c50157feb308090d84b52cd84e80a2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 1 Dec 2024 21:40:43 +0100 Subject: [PATCH] avformat/iamf_parse: Check output_channel_count Fixes: -nan is outside the range of representable values of type 'int' Fixes: 377072730/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6545416570601472 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/iamf_parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 2394536f72..7cf27651ee 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -422,7 +422,7 @@ static int ambisonics_config(void *s, AVIOContext *pb, output_channel_count = avio_r8(pb); // C substream_count = avio_r8(pb); // N - if (audio_element->nb_substreams != substream_count) + if (audio_element->nb_substreams != substream_count || output_channel_count == 0) return AVERROR_INVALIDDATA; order = floor(sqrt(output_channel_count - 1));