diff options
| author | James Almer <jamrial@gmail.com> | 2024-07-19 00:00:43 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2024-07-19 21:07:32 -0300 |
| commit | 9ce065c90decf1a07a810ccb699a491d41a720d2 (patch) | |
| tree | 43bff232246d1d66856958fcb528cc4b806cccea | |
| parent | e30bc8a963eab1097bfb985351ca7eaf1f272ba6 (diff) | |
| download | ffmpeg-9ce065c90decf1a07a810ccb699a491d41a720d2.tar.gz | |
avformat/iamf_parse: sanitize audio_roll_distance values
Ensure the values are spec complaint and that no integer overflow can happen.
Signed-off-by: James Almer <jamrial@gmail.com>
| -rw-r--r-- | libavformat/iamf_parse.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index a176c7d13a..dd394c5564 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -38,7 +38,7 @@ static int opus_decoder_config(IAMFCodecConfig *codec_config, { int left = len - avio_tell(pb); - if (left < 11) + if (left < 11 || codec_config->audio_roll_distance >= 0) return AVERROR_INVALIDDATA; codec_config->extradata = av_malloc(left + 8); @@ -64,6 +64,9 @@ static int aac_decoder_config(IAMFCodecConfig *codec_config, int object_type_id, codec_id, stream_type; int ret, tag, left; + if (codec_config->audio_roll_distance >= 0) + return AVERROR_INVALIDDATA; + tag = avio_r8(pb); if (tag != MP4DecConfigDescrTag) return AVERROR_INVALIDDATA; @@ -118,6 +121,9 @@ static int flac_decoder_config(IAMFCodecConfig *codec_config, { int left; + if (codec_config->audio_roll_distance) + return AVERROR_INVALIDDATA; + avio_skip(pb, 4); // METADATA_BLOCK_HEADER left = len - avio_tell(pb); @@ -146,7 +152,7 @@ static int ipcm_decoder_config(IAMFCodecConfig *codec_config, }; int sample_format = avio_r8(pb); // 0 = BE, 1 = LE int sample_size = (avio_r8(pb) / 8 - 2); // 16, 24, 32 - if (sample_format > 1 || sample_size > 2) + if (sample_format > 1 || sample_size > 2 || codec_config->audio_roll_distance) return AVERROR_INVALIDDATA; codec_config->codec_id = sample_fmt[sample_format][sample_size]; @@ -246,6 +252,12 @@ static int codec_config_obu(void *s, IAMFContext *c, AVIOContext *pb, int len) if (ret < 0) goto fail; + if ((codec_config->nb_samples > INT_MAX) || + (-codec_config->audio_roll_distance > INT_MAX / codec_config->nb_samples)) { + ret = AVERROR_INVALIDDATA; + goto fail; + } + c->codec_configs[c->nb_codec_configs++] = codec_config; len -= avio_tell(pbc); |