Stowage/ffmpeg
2
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-08 06:09:50 +00:00
Code Issues Projects Releases Packages Wiki Activity

avformat/iamf_parse: sanitize audio_roll_distance values

Browse source 
Ensure the values are spec complaint and that no integer overflow can happen.

Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2024-07-19 00:00:43 -03:00
parent e30bc8a963
commit 9ce065c90d
1 changed files with 14 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
libavformat/iamf_parse.c
View file

@ -38,7 +38,7 @@ static int opus_decoder_config(IAMFCodecConfig *codec_config,
{
int left = len - avio_tell(pb);
if (left < 11)
if (left < 11 || codec_config->audio_roll_distance >= 0)
return AVERROR_INVALIDDATA;
codec_config->extradata = av_malloc(left + 8);
@ -64,6 +64,9 @@ static int aac_decoder_config(IAMFCodecConfig *codec_config,
int object_type_id, codec_id, stream_type;
int ret, tag, left;
if (codec_config->audio_roll_distance >= 0)
return AVERROR_INVALIDDATA;
tag = avio_r8(pb);
if (tag != MP4DecConfigDescrTag)
return AVERROR_INVALIDDATA;
@ -118,6 +121,9 @@ static int flac_decoder_config(IAMFCodecConfig *codec_config,
{
int left;
if (codec_config->audio_roll_distance)
return AVERROR_INVALIDDATA;
avio_skip(pb, 4); // METADATA_BLOCK_HEADER
left = len - avio_tell(pb);
@ -146,7 +152,7 @@ static int ipcm_decoder_config(IAMFCodecConfig *codec_config,
};
int sample_format = avio_r8(pb); // 0 = BE, 1 = LE
int sample_size = (avio_r8(pb) / 8 - 2); // 16, 24, 32
if (sample_format > 1 || sample_size > 2)
if (sample_format > 1 || sample_size > 2 || codec_config->audio_roll_distance)
return AVERROR_INVALIDDATA;
codec_config->codec_id = sample_fmt[sample_format][sample_size];
@ -246,6 +252,12 @@ static int codec_config_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
if (ret < 0)
goto fail;
if ((codec_config->nb_samples > INT_MAX) ||
(-codec_config->audio_roll_distance > INT_MAX / codec_config->nb_samples)) {
ret = AVERROR_INVALIDDATA;
goto fail;
}
c->codec_configs[c->nb_codec_configs++] = codec_config;
len -= avio_tell(pbc);