har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/iamf_parse: sanitize audio_roll_distance values

Browse Source 
Ensure the values are spec complaint and that no integer overflow can happen.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 9ce065c90decf1a07a810ccb699a491d41a720d2)
This commit is contained in:
James Almer 2024-07-19 00:00:43 -03:00
parent db90c46fff
commit fdd3e3504e
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
libavformat/iamf_parse.c
View File

@ -38,7 +38,7 @@ static int opus_decoder_config(IAMFCodecConfig *codec_config,
{ {
int left = len - avio_tell(pb); int left = len - avio_tell(pb);
if (left < 11) if (left < 11 || codec_config->audio_roll_distance >= 0)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
codec_config->extradata = av_malloc(left + 8); codec_config->extradata = av_malloc(left + 8);
@ -64,6 +64,9 @@ static int aac_decoder_config(IAMFCodecConfig *codec_config,
int object_type_id, codec_id, stream_type; int object_type_id, codec_id, stream_type;
int ret, tag, left; int ret, tag, left;
if (codec_config->audio_roll_distance >= 0)
return AVERROR_INVALIDDATA;
tag = avio_r8(pb); tag = avio_r8(pb);
if (tag != MP4DecConfigDescrTag) if (tag != MP4DecConfigDescrTag)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
@ -118,6 +121,9 @@ static int flac_decoder_config(IAMFCodecConfig *codec_config,
{ {
int left; int left;
if (codec_config->audio_roll_distance)
return AVERROR_INVALIDDATA;
avio_skip(pb, 4); // METADATA_BLOCK_HEADER avio_skip(pb, 4); // METADATA_BLOCK_HEADER
left = len - avio_tell(pb); left = len - avio_tell(pb);
@ -146,7 +152,7 @@ static int ipcm_decoder_config(IAMFCodecConfig *codec_config,
}; };
int sample_format = avio_r8(pb); // 0 = BE, 1 = LE int sample_format = avio_r8(pb); // 0 = BE, 1 = LE
int sample_size = (avio_r8(pb) / 8 - 2); // 16, 24, 32 int sample_size = (avio_r8(pb) / 8 - 2); // 16, 24, 32
if (sample_format > 1 || sample_size > 2) if (sample_format > 1 || sample_size > 2 || codec_config->audio_roll_distance)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
codec_config->codec_id = sample_fmt[sample_format][sample_size]; codec_config->codec_id = sample_fmt[sample_format][sample_size];
@ -246,6 +252,12 @@ static int codec_config_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
if (ret < 0) if (ret < 0)
goto fail; goto fail;
if ((codec_config->nb_samples > INT_MAX) ||
(-codec_config->audio_roll_distance > INT_MAX / codec_config->nb_samples)) {
ret = AVERROR_INVALIDDATA;
goto fail;
}
c->codec_configs[c->nb_codec_configs++] = codec_config; c->codec_configs[c->nb_codec_configs++] = codec_config;
len -= avio_tell(pbc); len -= avio_tell(pbc);