avcodec/wavpack: Treat the first block coding too many channels as an error
authorMichael Niedermayer <michael@niedermayer.cc>
Wed, 7 Dec 2016 11:06:16 +0000 (12:06 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Wed, 7 Dec 2016 12:16:32 +0000 (13:16 +0100)
Fixes memleak
Fixes: 236/8aeebc9ca49b91bf71c114dcefac56c154a3a563

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/wavpack.c

index 071e2be..2bd7783 100644 (file)
@@ -1016,7 +1016,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
 
     if (wc->ch_offset + s->stereo >= avctx->channels) {
         av_log(avctx, AV_LOG_WARNING, "Too many channels coded in a packet.\n");
-        return (avctx->err_recognition & AV_EF_EXPLODE) ? AVERROR_INVALIDDATA : 0;
+        return ((avctx->err_recognition & AV_EF_EXPLODE) || !wc->ch_offset) ? AVERROR_INVALIDDATA : 0;
     }
 
     samples_l = frame->extended_data[wc->ch_offset];