avcodec/speexdec: further check for sane frame_size values

Prevent potential integer overflows.

James Almer committed 2 years ago

Commit 0895ef01 parent d897bbb1 file · +3 −2Browse files

Unified · Split

libavcodec/speexdec.c+3−2

@@ -1421,9 +1421,10 @@ static int parse_speex_extradata(AVCodecContext *avctx, · 1420 unmodified lines
1421	1421	return AVERROR_INVALIDDATA;
1422	1422	s->bitrate = bytestream_get_le32(&buf);
1423	1423	s->frame_size = bytestream_get_le32(&buf);
1424		− if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0))
	1424	+ if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0) \|\|
	1425	+ s->frame_size > INT32_MAX >> (s->mode > 0))
1425	1426	return AVERROR_INVALIDDATA;
1426		− s->frame_size *= 1 + (s->mode > 0);
	1427	+ s->frame_size <<= (s->mode > 0);
1427	1428	s->vbr = bytestream_get_le32(&buf);
1428	1429	s->frames_per_packet = bytestream_get_le32(&buf);
1429	1430	if (s->frames_per_packet <= 0 \|\|