[PR] avformat/iamf: bound the output mix gain duration by the audio elements (PR #23905)

PR #23905 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23905
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23905.patch

Fixes: unbounded allocation
Fixes: poc_output_mix_config_dos.iamf
Fixes: 387qWpjUgeKH
Found-by: Duong Tran Thai (CyStack)




>From 684798baa906d0704a7fdcc945b52e68b34b645f Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 22 Jul 2026 23:51:27 +0200
Subject: [PATCH] avformat/iamf: bound the output mix gain duration by the
 audio elements

Fixes: unbounded allocation
Fixes: poc_output_mix_config_dos.iamf
Fixes: 387qWpjUgeKH
Found-by: Duong Tran Thai (CyStack)
---
 libavformat/iamf_parse.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 4c2df2c9e6..26c34d8a96 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -1042,6 +1042,7 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le
     nb_submixes = ffio_read_leb(pbc);
     for (int i = 0; i < nb_submixes; i++) {
         AVIAMFSubmix *sub_mix;
+        const IAMFAudioElement *submix_audio_element = NULL;
         unsigned nb_elements, nb_layouts;
 
         sub_mix = av_iamf_mix_presentation_add_submix(mix);
@@ -1076,6 +1077,7 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le
                 ret = AVERROR_INVALIDDATA;
                 goto fail;
             }
+            submix_audio_element = audio_element;
 
             for (int k = 0; k < mix_presentation->count_label; k++) {
                 char *annotation = NULL;
@@ -1101,7 +1103,14 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le
             submix_element->default_mix_gain = av_make_q(sign_extend(avio_rb16(pbc), 16), 1 << 8);
         }
 
-        ret = param_parse(s, c, pbc, AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN, NULL, &sub_mix->output_mix_config);
+        if (!submix_audio_element) {
+            av_log(s, AV_LOG_ERROR, "Mix presentation %u has a submix with no audio elements\n",
+                   mix_presentation_id);
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
+        }
+        ret = param_parse(s, c, pbc, AV_IAMF_PARAMETER_DEFINITION_MIX_GAIN,
+                          submix_audio_element, &sub_mix->output_mix_config);
         if (ret < 0)
             goto fail;
         sub_mix->default_mix_gain = av_make_q(sign_extend(avio_rb16(pbc), 16), 1 << 8);
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]