From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id B74D94878C for ; Fri, 16 Feb 2024 14:19:52 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 936DB68D295; Fri, 16 Feb 2024 16:19:49 +0200 (EET) Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id CE9CD68CB35 for ; Fri, 16 Feb 2024 16:19:43 +0200 (EET) Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-6e10d08cb4fso1809888b3a.0 for ; Fri, 16 Feb 2024 06:19:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1708093181; x=1708697981; darn=ffmpeg.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=1yFg6WaoVZObyQDGoWOjRwrgIpPEy0tLYoogB5L4wIE=; b=MXZpwrhWHJpxaHNWJOBlPq6a4TF/tb/JL9jPKspu+NQ7So7kgnLmHtifeUTjmBZbYR Ygqmj2Melq2yBh8knmvkYWN/5th7it7DEj3LoSwWpdA1aeM1Qywawgtl4UKbDu0R0Ebf huzWZ8fRp2LsZY8AAhgKwlOIJndInSYkYDWsiEW0peNeudrUsUnhCeEwqdM7lU3kHRWU TGJ2ohQaHmiJ6WM+OXmK4Iwa9ZUIoZ6bsQdBHnEddR4tC4k/1yFEcm9nVfIRcZcQOawt 2x1jncZoXEI9NZ0YiHuWYoKONxOjLEiJrOWhWoAjbcMISxWd4maD06za80m9nJim2H7E oYlg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1708093181; x=1708697981; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=1yFg6WaoVZObyQDGoWOjRwrgIpPEy0tLYoogB5L4wIE=; b=RTlSHatZEwvJmrn8UkyYnnoLjeUyrSNAll87GNv5j6dRnh39XeSzdhhrH5qbQ007l2 y/6wIr70x30KgWFKZlZuE8kGEKwy+aG3R4T1URfA6V82pKIdJq9M2cJz+cbjup7NIw/p vfJP9ZePZVoL8ONcA7O/rJ7AcKnP/7HcvRC8h71afuJ7F2b2a/RomMpIUt5S8Gel0mjD +FXqHX4icGFoCl5H9yDvyC1WlsTFxSDWouLGeHLJYO+ugvOHUspQtNdBfY/Co7d8aPGz 3Nba4XYLTcX5UOglMr/xOxY58bXCasjopes7i88ZMe0hLhvATPfx0hUz+VKsdaIGuA0X znrQ== X-Gm-Message-State: AOJu0YzT1QxJ4kaiGZV7rqem/IpwAaXbizEXOjEwb1z5k+fAwKo6YzOo Ckwi8Jc6MbeDXvSunXhsl7iJLKRB2CgW6Iux35GPanyejurE9SsZCOmYeq7R X-Google-Smtp-Source: AGHT+IEXcwGslWayo4X3t3b08PVYUenJEafUj1F/QDCzCGxZPU+cNbTd4RTW+BTi0suUwI116ngIbw== X-Received: by 2002:a05:6a21:1786:b0:19e:4e41:7ae0 with SMTP id nx6-20020a056a21178600b0019e4e417ae0mr11452376pzb.20.1708093180768; Fri, 16 Feb 2024 06:19:40 -0800 (PST) Received: from localhost.localdomain (host197.190-225-105.telecom.net.ar. [190.225.105.197]) by smtp.gmail.com with ESMTPSA id h7-20020a632107000000b005cf5cbac29asm3299545pgh.53.2024.02.16.06.19.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Feb 2024 06:19:40 -0800 (PST) From: James Almer To: ffmpeg-devel@ffmpeg.org Date: Fri, 16 Feb 2024 11:19:25 -0300 Message-ID: <20240216141925.3293-1-jamrial@gmail.com> X-Mailer: git-send-email 2.43.1 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] avcodec/speexdec: check for sane s->frame_size values X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: Fixes heap buffer overflows Reported-by: sploitem Signed-off-by: James Almer --- libavcodec/speexdec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c index 51c5834769..4d8052d585 100644 --- a/libavcodec/speexdec.c +++ b/libavcodec/speexdec.c @@ -1420,7 +1420,10 @@ static int parse_speex_extradata(AVCodecContext *avctx, if (s->nb_channels <= 0 || s->nb_channels > 2) return AVERROR_INVALIDDATA; s->bitrate = bytestream_get_le32(&buf); - s->frame_size = (1 + (s->mode > 0)) * bytestream_get_le32(&buf); + s->frame_size = bytestream_get_le32(&buf); + if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0)) + return AVERROR_INVALIDDATA; + s->frame_size *= 1 + (s->mode > 0); s->vbr = bytestream_get_le32(&buf); s->frames_per_packet = bytestream_get_le32(&buf); if (s->frames_per_packet <= 0 || -- 2.43.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".