LAV
/
FFmpeg
1
0
Fork 0
Code

avcodec/speexdec: check for sane frame_size values 

Regression since ab39cc36c7.

Fixes heap buffer overflows
Fixes ticket #10866

Reported-by: sploitem <sploitem@gmail.com>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2024-02-16 11:17:13 -03:00
parent 7ed1e806e7
commit 66b50445cb
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/speexdec.c
View File

@ -1420,7 +1420,10 @@ static int parse_speex_extradata(AVCodecContext *avctx,
if (s->nb_channels <= 0 || s->nb_channels > 2)
return AVERROR_INVALIDDATA;
s->bitrate = bytestream_get_le32(&buf);
s->frame_size = (1 + (s->mode > 0)) * bytestream_get_le32(&buf);
s->frame_size = bytestream_get_le32(&buf);
if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0))
return AVERROR_INVALIDDATA;
s->frame_size *= 1 + (s->mode > 0);
s->vbr = bytestream_get_le32(&buf);
s->frames_per_packet = bytestream_get_le32(&buf);
if (s->frames_per_packet <= 0 ||