[FFmpeg-devel] [PR] avcodec/vorbisdec: validate windowtype and transformtype (PR #21547)

[hassanhany via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21547 opened by hassanhany
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21547
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21547.patch

validates the windowtype and transformtype as required by the Vorbis spec in section 4.2.4 the part about modes "verify ranges; zero is the only legal value in Vorbis I for [vorbis_mode_windowtype] and [vorbis_mode_transformtype]."


>From bcfd563e25adb1e818b309018b7c03b684668751 Mon Sep 17 00:00:00 2001
From: Hassan Hany <hassanhanyrashad@gmail.com>
Date: Thu, 22 Jan 2026 15:31:41 +0200
Subject: [PATCH] avcodec/vorbisdec: validate windowtype and transformtype

---
 libavcodec/vorbisdec.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index 60a83f394f..1bfebda101 100644
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -908,8 +908,14 @@ static int vorbis_parse_setup_hdr_modes(vorbis_context *vc)
         vorbis_mode *mode_setup = &vc->modes[i];
 
         mode_setup->blockflag     = get_bits1(gb);
-        mode_setup->windowtype    = get_bits(gb, 16); //FIXME check
-        mode_setup->transformtype = get_bits(gb, 16); //FIXME check
+        mode_setup->windowtype    = get_bits(gb, 16);
+        mode_setup->transformtype = get_bits(gb, 16);
+        if (mode_setup->transformtype != 0 || mode_setup->windowtype != 0) {
+            av_log(vc->avctx, AV_LOG_ERROR,
+                   "Invalid mode: windowtype %u, transformtype %u (both must be 0)\n",
+                    mode_setup->windowtype, mode_setup->transformtype);
+            return AVERROR_INVALIDDATA;
+        }
         GET_VALIDATED_INDEX(mode_setup->mapping, 8, vc->mapping_count);
 
         ff_dlog(NULL, " %u mode: blockflag %d, windowtype %d, transformtype %d, mapping %d\n",
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org