From patchwork Fri Feb 16 14:19:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Almer X-Patchwork-Id: 46297 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:b819:b0:19e:cdac:8cce with SMTP id fi25csp1281524pzb; Fri, 16 Feb 2024 06:19:53 -0800 (PST) X-Forwarded-Encrypted: i=2; AJvYcCU5ajpcFHEjkVhPMijJGr7p1bmWOdkEsmiD9zPKYnS8HZLgEM4C3tT6FFy0687TzXoC/63FJPtLg3ix0//LKcPgfMqoziNAsm4nyA== X-Google-Smtp-Source: AGHT+IEqCvxCXNS1izjp+FcvrioGP/CL4a3aLEqeifv9uQeXqEToCcDDbmi8V+acX+rxfvgMvaTK X-Received: by 2002:a17:906:4894:b0:a3d:bbea:da41 with SMTP id v20-20020a170906489400b00a3dbbeada41mr2131110ejq.12.1708093193420; Fri, 16 Feb 2024 06:19:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1708093193; cv=none; d=google.com; s=arc-20160816; b=WiUA3oDwXjkS8+f2WWCkM63B2v0etILRV138WyJpDaZQfPeyWxIKFMeewIxtc6UAvr v7TxkHQbUf7gzrtufB4CsJAPuEYPwrA/29eQyXYgsGPCUjfFPksVnsmvEYKYRKDkthc3 Yr+qj9xzeaImXKXRITUp+N2+kGlCVKccoF6QZPiccq4tyzm1i39Ef1gttEivev8xygYA bb/8PsjE9ZHLGWuE1xBa8krME8/1pSI0/oezJMYXis9Jk5X1yDgezgkxpShQk7PNIJGM UYQGoo3ckilDvSx6MOPspErS2tpMC8eS3ns4X1C/sblcLnUS0yVmy7r5CJiCfvyfBqst qldQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe :list-help:list-post:list-archive:list-unsubscribe:list-id :precedence:subject:mime-version:message-id:date:to:from :dkim-signature:delivered-to; bh=SYuWKZNz5jwb7l5eBBx3kPiPkoFQZ0Pz7DrRsH4soTo=; fh=YOA8vD9MJZuwZ71F/05pj6KdCjf6jQRmzLS+CATXUQk=; b=Jp/K0+JwtT4ETK3KhRj/oJrQC+BSguuuyiYbx/a7PdWf/knZtrtPDWD+PVSLpSijRg 7RiTp+K5VOHiJ44PAWv/Alh3TNdPIxze9fJQ33xL3mqUWAKbMb9E7RZfvTZ2WgeyS+x7 hQ9i5PXkt4w6Ncqzoi3Ex7xfmaNqe+fRY/MWA1D9EmdbRoOifbVZ6mxxNqOPGmoVP/4G 7GvQcFCMSxV4FD7ZVrOs0G/7ub5uXJEzZeRrrxS7skBaOXWolfKa8GA76KOQSrvh8ygK gGUwdpM+0hy9TAXlg4nbmSsLAEBq0UzWm9NtGqFbxOFT9LbQFLMCp2N0ynWScExQtVf+ TpjQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20230601 header.b=MXZpwrhW; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id d15-20020a1709067f0f00b00a3d7e2d46d0si1677932ejr.957.2024.02.16.06.19.52; Fri, 16 Feb 2024 06:19:53 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20230601 header.b=MXZpwrhW; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id CA0E468D297; Fri, 16 Feb 2024 16:19:49 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id CE9CD68CB35 for ; Fri, 16 Feb 2024 16:19:43 +0200 (EET) Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-6e10d08cb4fso1809888b3a.0 for ; Fri, 16 Feb 2024 06:19:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1708093181; x=1708697981; darn=ffmpeg.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=1yFg6WaoVZObyQDGoWOjRwrgIpPEy0tLYoogB5L4wIE=; b=MXZpwrhWHJpxaHNWJOBlPq6a4TF/tb/JL9jPKspu+NQ7So7kgnLmHtifeUTjmBZbYR Ygqmj2Melq2yBh8knmvkYWN/5th7it7DEj3LoSwWpdA1aeM1Qywawgtl4UKbDu0R0Ebf huzWZ8fRp2LsZY8AAhgKwlOIJndInSYkYDWsiEW0peNeudrUsUnhCeEwqdM7lU3kHRWU TGJ2ohQaHmiJ6WM+OXmK4Iwa9ZUIoZ6bsQdBHnEddR4tC4k/1yFEcm9nVfIRcZcQOawt 2x1jncZoXEI9NZ0YiHuWYoKONxOjLEiJrOWhWoAjbcMISxWd4maD06za80m9nJim2H7E oYlg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1708093181; x=1708697981; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=1yFg6WaoVZObyQDGoWOjRwrgIpPEy0tLYoogB5L4wIE=; b=RTlSHatZEwvJmrn8UkyYnnoLjeUyrSNAll87GNv5j6dRnh39XeSzdhhrH5qbQ007l2 y/6wIr70x30KgWFKZlZuE8kGEKwy+aG3R4T1URfA6V82pKIdJq9M2cJz+cbjup7NIw/p vfJP9ZePZVoL8ONcA7O/rJ7AcKnP/7HcvRC8h71afuJ7F2b2a/RomMpIUt5S8Gel0mjD +FXqHX4icGFoCl5H9yDvyC1WlsTFxSDWouLGeHLJYO+ugvOHUspQtNdBfY/Co7d8aPGz 3Nba4XYLTcX5UOglMr/xOxY58bXCasjopes7i88ZMe0hLhvATPfx0hUz+VKsdaIGuA0X znrQ== X-Gm-Message-State: AOJu0YzT1QxJ4kaiGZV7rqem/IpwAaXbizEXOjEwb1z5k+fAwKo6YzOo Ckwi8Jc6MbeDXvSunXhsl7iJLKRB2CgW6Iux35GPanyejurE9SsZCOmYeq7R X-Received: by 2002:a05:6a21:1786:b0:19e:4e41:7ae0 with SMTP id nx6-20020a056a21178600b0019e4e417ae0mr11452376pzb.20.1708093180768; Fri, 16 Feb 2024 06:19:40 -0800 (PST) Received: from localhost.localdomain (host197.190-225-105.telecom.net.ar. [190.225.105.197]) by smtp.gmail.com with ESMTPSA id h7-20020a632107000000b005cf5cbac29asm3299545pgh.53.2024.02.16.06.19.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Feb 2024 06:19:40 -0800 (PST) From: James Almer To: ffmpeg-devel@ffmpeg.org Date: Fri, 16 Feb 2024 11:19:25 -0300 Message-ID: <20240216141925.3293-1-jamrial@gmail.com> X-Mailer: git-send-email 2.43.1 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] avcodec/speexdec: check for sane s->frame_size values X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: 3Q4nVq8CpiFz Fixes heap buffer overflows Reported-by: sploitem Signed-off-by: James Almer --- libavcodec/speexdec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c index 51c5834769..4d8052d585 100644 --- a/libavcodec/speexdec.c +++ b/libavcodec/speexdec.c @@ -1420,7 +1420,10 @@ static int parse_speex_extradata(AVCodecContext *avctx, if (s->nb_channels <= 0 || s->nb_channels > 2) return AVERROR_INVALIDDATA; s->bitrate = bytestream_get_le32(&buf); - s->frame_size = (1 + (s->mode > 0)) * bytestream_get_le32(&buf); + s->frame_size = bytestream_get_le32(&buf); + if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0)) + return AVERROR_INVALIDDATA; + s->frame_size *= 1 + (s->mode > 0); s->vbr = bytestream_get_le32(&buf); s->frames_per_packet = bytestream_get_le32(&buf); if (s->frames_per_packet <= 0 ||