[FFmpeg-devel] [PATCH] avformat/oggparseflac: check init_get_bits' result

* [FFmpeg-devel] [PATCH] avformat/oggparseflac: check init_get_bits' result
@ 2023-05-30 21:21 Paul Arzelier
  2023-05-30 21:28 ` James Almer
  0 siblings, 1 reply; 2+ messages in thread
From: Paul Arzelier @ 2023-05-30 21:21 UTC (permalink / raw)
  To: ffmpeg-devel; +Cc: Paul Arzelier, Polochon-street

From: Polochon-street <polochonstreet@gmx.fr>

Check init_get_bits' result for NULL, to avoid dereferencing a NULL
pointer later (CWE-476).
Without this, a segfault happens when trying to decode a handcrafted
ogg-flac file with an absurdly long (e.g. 268435455 bytes) ogg header.

Thanks to jamrial for basically writing this patch after I reported the bug!

Signed-off-by: Paul Arzelier <paul.arzelier@free.fr>
---
 libavformat/oggparseflac.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavformat/oggparseflac.c b/libavformat/oggparseflac.c
index eef6e09927..557440d94b 100644
--- a/libavformat/oggparseflac.c
+++ b/libavformat/oggparseflac.c
@@ -40,7 +40,10 @@ flac_header (AVFormatContext * s, int idx)
     if (os->buf[os->pstart] == 0xff)
         return 0;
 
-    init_get_bits(&gb, os->buf + os->pstart, os->psize*8);
+    ret = init_get_bits8(&gb, os->buf + os->pstart, os->psize);
+    if (ret < 0)
+        return ret;
+
     skip_bits1(&gb); /* metadata_last */
     mdt = get_bits(&gb, 7);
 
-- 
2.40.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

^ permalink raw reply	[flat|nested] 2+ messages in thread