libfdk-aacdec: Correct buffer_size parameter

Message ID 20170606103331.59956-1-martin@martin.st
State Committed
Commit f61265571d68c410f5307c240a7f9c95c247fb54
Headers show

Commit Message

Martin Storsjö June 6, 2017, 10:33 a.m.
From: Michael Niedermayer <michael@niedermayer.cc>

The timeDataSize argument to aacDecoder_DecodeFrame() seems undocumented
and until 2016 04 (203e3f28fbebec7011342017fafc2a0bda0ce530) unused.
After that commit libfdk-aacdec interprets it as size in sample units
and memsets that on error.

FFmpeg as well as others (like GStreamer) did interpret it as size in
bytes.

Fixes: 1442/clusterfuzz-testcase-minimized-4540199973421056 (This requires recent libfdk to reproduce)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
---
 libavcodec/libfdk-aacdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Diego Biurrun June 6, 2017, 12:30 p.m. | #1
On Tue, Jun 06, 2017 at 01:33:31PM +0300, Martin Storsjö wrote:
> From: Michael Niedermayer <michael@niedermayer.cc>
> 
> The timeDataSize argument to aacDecoder_DecodeFrame() seems undocumented
> and until 2016 04 (203e3f28fbebec7011342017fafc2a0bda0ce530) unused.
> After that commit libfdk-aacdec interprets it as size in sample units
> and memsets that on error.
> 
> FFmpeg as well as others (like GStreamer) did interpret it as size in
> bytes.
> 
> Fixes: 1442/clusterfuzz-testcase-minimized-4540199973421056 (This requires recent libfdk to reproduce)
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> ---
>  libavcodec/libfdk-aacdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

probably OK

Diego

Patch

diff --git a/libavcodec/libfdk-aacdec.c b/libavcodec/libfdk-aacdec.c
index cdf7a0571f..84873a2fff 100644
--- a/libavcodec/libfdk-aacdec.c
+++ b/libavcodec/libfdk-aacdec.c
@@ -325,7 +325,7 @@  static int fdk_aac_decode_frame(AVCodecContext *avctx, void *data,
         return AVERROR_INVALIDDATA;
     }
 
-    err = aacDecoder_DecodeFrame(s->handle, (INT_PCM *) s->decoder_buffer, s->decoder_buffer_size, 0);
+    err = aacDecoder_DecodeFrame(s->handle, (INT_PCM *) s->decoder_buffer, s->decoder_buffer_size / sizeof(INT_PCM), 0);
     if (err == AAC_DEC_NOT_ENOUGH_BITS) {
         ret = avpkt->size - valid;
         goto end;