diff options
| author | James Almer <jamrial@gmail.com> | 2024-02-17 09:45:57 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2024-02-17 09:51:23 -0300 |
| commit | 0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c (patch) | |
| tree | c7dfeddb6acf339fc0d9e0a283f96550d28d1547 | |
| parent | d897bbb48dcda23ca3d32332d5be4717dd66e551 (diff) | |
avcodec/speexdec: further check for sane frame_size values
Prevent potential integer overflows.
Signed-off-by: James Almer <jamrial@gmail.com>
| -rw-r--r-- | libavcodec/speexdec.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c index 4d8052d585..ba0df687de 100644 --- a/libavcodec/speexdec.c +++ b/libavcodec/speexdec.c @@ -1421,9 +1421,10 @@ static int parse_speex_extradata(AVCodecContext *avctx, return AVERROR_INVALIDDATA; s->bitrate = bytestream_get_le32(&buf); s->frame_size = bytestream_get_le32(&buf); - if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0)) + if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0) || + s->frame_size > INT32_MAX >> (s->mode > 0)) return AVERROR_INVALIDDATA; - s->frame_size *= 1 + (s->mode > 0); + s->frame_size <<= (s->mode > 0); s->vbr = bytestream_get_le32(&buf); s->frames_per_packet = bytestream_get_le32(&buf); if (s->frames_per_packet <= 0 || |