Ensure the values are spec complaint and that no integer overflow can happen.
Showing the changes to libavformat (1 of 1 file). Show all
Unified · Split
| @@ -38,7 +38,7 @@ static int opus_decoder_config(IAMFCodecConfig *codec_config, · 37 unmodified lines | ||
| 38 | 38 | { |
| 39 | 39 | int left = len - avio_tell(pb); |
| 40 | 40 | |
| 41 | − if (left < 11) | |
| 41 | + if (left < 11 || codec_config->audio_roll_distance >= 0) | |
| 42 | 42 | return AVERROR_INVALIDDATA; |
| 43 | 43 | |
| 44 | 44 | codec_config->extradata = av_malloc(left + 8); |
| @@ -64,6 +64,9 @@ static int aac_decoder_config(IAMFCodecConfig *codec_config, · 19 unmodified lines | ||
| 64 | 64 | int object_type_id, codec_id, stream_type; |
| 65 | 65 | int ret, tag, left; |
| 66 | 66 | |
| 67 | + if (codec_config->audio_roll_distance >= 0) | |
| 68 | + return AVERROR_INVALIDDATA; | |
| 69 | + | |
| 67 | 70 | tag = avio_r8(pb); |
| 68 | 71 | if (tag != MP4DecConfigDescrTag) |
| 69 | 72 | return AVERROR_INVALIDDATA; |
| @@ -118,6 +121,9 @@ static int flac_decoder_config(IAMFCodecConfig *codec_config, · 48 unmodified lines | ||
| 118 | 121 | { |
| 119 | 122 | int left; |
| 120 | 123 | |
| 124 | + if (codec_config->audio_roll_distance) | |
| 125 | + return AVERROR_INVALIDDATA; | |
| 126 | + | |
| 121 | 127 | avio_skip(pb, 4); // METADATA_BLOCK_HEADER |
| 122 | 128 | |
| 123 | 129 | left = len - avio_tell(pb); |
| @@ -146,7 +152,7 @@ static int ipcm_decoder_config(IAMFCodecConfig *codec_config, · 22 unmodified lines | ||
| 146 | 152 | }; |
| 147 | 153 | int sample_format = avio_r8(pb); // 0 = BE, 1 = LE |
| 148 | 154 | int sample_size = (avio_r8(pb) / 8 - 2); // 16, 24, 32 |
| 149 | − if (sample_format > 1 || sample_size > 2) | |
| 155 | + if (sample_format > 1 || sample_size > 2 || codec_config->audio_roll_distance) | |
| 150 | 156 | return AVERROR_INVALIDDATA; |
| 151 | 157 | |
| 152 | 158 | codec_config->codec_id = sample_fmt[sample_format][sample_size]; |
| @@ -246,6 +252,12 @@ static int codec_config_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) · 93 unmodified lines | ||
| 246 | 252 | if (ret < 0) |
| 247 | 253 | goto fail; |
| 248 | 254 | |
| 255 | + if ((codec_config->nb_samples > INT_MAX) || | |
| 256 | + (-codec_config->audio_roll_distance > INT_MAX / codec_config->nb_samples)) { | |
| 257 | + ret = AVERROR_INVALIDDATA; | |
| 258 | + goto fail; | |
| 259 | + } | |
| 260 | + | |
| 249 | 261 | c->codec_configs[c->nb_codec_configs++] = codec_config; |
| 250 | 262 | |
| 251 | 263 | len -= avio_tell(pbc); |