| Message ID | 20240216141925.3293-1-jamrial@gmail.com |
|---|---|
| State | Accepted |
| Commit | 66b50445cb36cf6adb49c2397362509aedb42c71 |
| Headers | show |
| Series | [FFmpeg-devel] avcodec/speexdec: check for sane s->frame_size values | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Fri, Feb 16, 2024 at 11:19:25AM -0300, James Almer wrote: > Fixes heap buffer overflows > > Reported-by: sploitem <sploitem@gmail.com> > Signed-off-by: James Almer <jamrial@gmail.com> > --- > libavcodec/speexdec.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) ok, though note that i do not know speexdec.c well enough to say that this is or is not sufficient thx [...]
diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c index 51c5834769..4d8052d585 100644 --- a/libavcodec/speexdec.c +++ b/libavcodec/speexdec.c @@ -1420,7 +1420,10 @@ static int parse_speex_extradata(AVCodecContext *avctx, if (s->nb_channels <= 0 || s->nb_channels > 2) return AVERROR_INVALIDDATA; s->bitrate = bytestream_get_le32(&buf); - s->frame_size = (1 + (s->mode > 0)) * bytestream_get_le32(&buf); + s->frame_size = bytestream_get_le32(&buf); + if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0)) + return AVERROR_INVALIDDATA; + s->frame_size *= 1 + (s->mode > 0); s->vbr = bytestream_get_le32(&buf); s->frames_per_packet = bytestream_get_le32(&buf); if (s->frames_per_packet <= 0 ||
Fixes heap buffer overflows Reported-by: sploitem <sploitem@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com> --- libavcodec/speexdec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)