diff mbox series

[FFmpeg-devel] avcodec/bonk: check level value to not reach invalid values

Message ID CAPYw7P60UGsqBanGZyCsVc8h7ckD135dumD7E2yfBby4YSvtBg@mail.gmail.com
State New
Headers show
Series [FFmpeg-devel] avcodec/bonk: check level value to not reach invalid values | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Paul B Mahol Nov. 22, 2022, 10:26 a.m. UTC 
Patch attached.

Comments

Michael Niedermayer Nov. 22, 2022, 7:22 p.m. UTC | #1 
On Tue, Nov 22, 2022 at 11:26:48AM +0100, Paul B Mahol wrote:
> Patch attached.

>  bonk.c |    8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 84abac919e9c120e48bb1a3f84be0697f620b66a  0001-avcodec-bonk-check-level-value-to-not-reach-invalid-.patch
> From 1b9204a39ea111f4fa34fe9cb4254dea2f20923d Mon Sep 17 00:00:00 2001
> From: Paul B Mahol <onemda@gmail.com>
> Date: Tue, 22 Nov 2022 11:27:39 +0100
> Subject: [PATCH] avcodec/bonk: check level value to not reach invalid values
> 
> Signed-off-by: Paul B Mahol <onemda@gmail.com>
> ---
>  libavcodec/bonk.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
[...]

> @@ -330,7 +333,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
>  
>      skip_bits(gb, s->skip);
>      if ((ret = intlist_read(s, s->k, s->n_taps, 0)) < 0)
> -        return ret;
> +        goto fail;
>  
>      for (int i = 0; i < s->n_taps; i++)
>          s->k[i] *= s->quant[i];
> @@ -345,7 +348,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
>  
>          predictor_init_state(s->k, state, s->n_taps);
>          if ((ret = intlist_read(s, s->input_samples, samples_per_packet, 1)) < 0)
> -            return ret;
> +            goto fail;
>  
>          for (int i = 0; i < samples_per_packet; i++) {
>              for (int j = 0; j < s->down_sampling - 1; j++) {
> @@ -390,6 +393,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
>      n = get_bits_count(gb) / 8;
>  
>      if (n > buf_size) {
> +fail:
>          s->bitstream_size = 0;
>          s->bitstream_index = 0;
>          return AVERROR_INVALIDDATA;
> -- 

LGTM

thx

[...]
diff mbox series

Patch

From 1b9204a39ea111f4fa34fe9cb4254dea2f20923d Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Tue, 22 Nov 2022 11:27:39 +0100
Subject: [PATCH] avcodec/bonk: check level value to not reach invalid values

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavcodec/bonk.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c
index 2b2e202428..4793bf2561 100644
--- a/libavcodec/bonk.c
+++ b/libavcodec/bonk.c
@@ -217,6 +217,9 @@  static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part)
             level += 1 << low_bits;
         }
 
+        if (level > 1 << 15)
+            return AVERROR_INVALIDDATA;
+
         if (x >= max_x)
             return AVERROR_INVALIDDATA;
 
@@ -330,7 +333,7 @@  static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
 
     skip_bits(gb, s->skip);
     if ((ret = intlist_read(s, s->k, s->n_taps, 0)) < 0)
-        return ret;
+        goto fail;
 
     for (int i = 0; i < s->n_taps; i++)
         s->k[i] *= s->quant[i];
@@ -345,7 +348,7 @@  static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
 
         predictor_init_state(s->k, state, s->n_taps);
         if ((ret = intlist_read(s, s->input_samples, samples_per_packet, 1)) < 0)
-            return ret;
+            goto fail;
 
         for (int i = 0; i < samples_per_packet; i++) {
             for (int j = 0; j < s->down_sampling - 1; j++) {
@@ -390,6 +393,7 @@  static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
     n = get_bits_count(gb) / 8;
 
     if (n > buf_size) {
+fail:
         s->bitstream_size = 0;
         s->bitstream_index = 0;
         return AVERROR_INVALIDDATA;
-- 
2.37.2