[FFmpeg-devel] [PATCH] avcodec/bonk: check level value to not reach invalid values

[Paul B Mahol <onemda@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 16 bytes --]

Patch attached.

[-- Attachment #2: 0001-avcodec-bonk-check-level-value-to-not-reach-invalid-.patch --]
[-- Type: text/x-patch, Size: 1726 bytes --]

From 1b9204a39ea111f4fa34fe9cb4254dea2f20923d Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Tue, 22 Nov 2022 11:27:39 +0100
Subject: [PATCH] avcodec/bonk: check level value to not reach invalid values

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavcodec/bonk.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c
index 2b2e202428..4793bf2561 100644
--- a/libavcodec/bonk.c
+++ b/libavcodec/bonk.c
@@ -217,6 +217,9 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part)
             level += 1 << low_bits;
         }
 
+        if (level > 1 << 15)
+            return AVERROR_INVALIDDATA;
+
         if (x >= max_x)
             return AVERROR_INVALIDDATA;
 
@@ -330,7 +333,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
 
     skip_bits(gb, s->skip);
     if ((ret = intlist_read(s, s->k, s->n_taps, 0)) < 0)
-        return ret;
+        goto fail;
 
     for (int i = 0; i < s->n_taps; i++)
         s->k[i] *= s->quant[i];
@@ -345,7 +348,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
 
         predictor_init_state(s->k, state, s->n_taps);
         if ((ret = intlist_read(s, s->input_samples, samples_per_packet, 1)) < 0)
-            return ret;
+            goto fail;
 
         for (int i = 0; i < samples_per_packet; i++) {
             for (int j = 0; j < s->down_sampling - 1; j++) {
@@ -390,6 +393,7 @@ static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
     n = get_bits_count(gb) / 8;
 
     if (n > buf_size) {
+fail:
         s->bitstream_size = 0;
         s->bitstream_index = 0;
         return AVERROR_INVALIDDATA;
-- 
2.37.2


[-- Attachment #3: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".