diff options
| author | James Almer <jamrial@gmail.com> | 2024-02-16 11:17:13 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2024-02-16 15:21:52 -0300 |
| commit | 66b50445cb36cf6adb49c2397362509aedb42c71 (patch) | |
| tree | 8c8a9ac92f6b3cf7c62c9bf4a0497b5327d8d2c5 | |
| parent | 7ed1e806e76092df27d7f984a554546a1cf1a175 (diff) | |
avcodec/speexdec: check for sane frame_size values
Regression since ab39cc36c72bb73318bb911acb66873de850a107.
Fixes heap buffer overflows
Fixes ticket #10866
Reported-by: sploitem <sploitem@gmail.com>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
| -rw-r--r-- | libavcodec/speexdec.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c index 51c5834769..4d8052d585 100644 --- a/libavcodec/speexdec.c +++ b/libavcodec/speexdec.c @@ -1420,7 +1420,10 @@ static int parse_speex_extradata(AVCodecContext *avctx, if (s->nb_channels <= 0 || s->nb_channels > 2) return AVERROR_INVALIDDATA; s->bitrate = bytestream_get_le32(&buf); - s->frame_size = (1 + (s->mode > 0)) * bytestream_get_le32(&buf); + s->frame_size = bytestream_get_le32(&buf); + if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0)) + return AVERROR_INVALIDDATA; + s->frame_size *= 1 + (s->mode > 0); s->vbr = bytestream_get_le32(&buf); s->frames_per_packet = bytestream_get_le32(&buf); if (s->frames_per_packet <= 0 || |