Skip to content

Commit 96349da

Browse files
committed
avcodec/apedec: Fix integer overflow
Fixes: out of array access Fixes: PoC.ape and others Found-by: Bingchang, Liu@VARAS of IIE Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit ba4beaf) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
1 parent 664201a commit 96349da

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

Diff for: libavcodec/apedec.c

+5-3
Original file line numberDiff line numberDiff line change
@@ -1419,6 +1419,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
14191419
int32_t *sample24;
14201420
int i, ch, ret;
14211421
int blockstodecode;
1422+
uint64_t decoded_buffer_size;
14221423

14231424
/* this should never be negative, but bad things will happen if it is, so
14241425
check it just to make sure. */
@@ -1474,7 +1475,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
14741475
skip_bits_long(&s->gb, offset);
14751476
}
14761477

1477-
if (!nblocks || nblocks > INT_MAX) {
1478+
if (!nblocks || nblocks > INT_MAX / 2 / sizeof(*s->decoded_buffer) - 8) {
14781479
av_log(avctx, AV_LOG_ERROR, "Invalid sample count: %"PRIu32".\n",
14791480
nblocks);
14801481
return AVERROR_INVALIDDATA;
@@ -1500,8 +1501,9 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
15001501
blockstodecode = s->samples;
15011502

15021503
/* reallocate decoded sample buffer if needed */
1503-
av_fast_malloc(&s->decoded_buffer, &s->decoded_size,
1504-
2 * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer));
1504+
decoded_buffer_size = 2LL * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer);
1505+
av_assert0(decoded_buffer_size <= INT_MAX);
1506+
av_fast_malloc(&s->decoded_buffer, &s->decoded_size, decoded_buffer_size);
15051507
if (!s->decoded_buffer)
15061508
return AVERROR(ENOMEM);
15071509
memset(s->decoded_buffer, 0, s->decoded_size);

0 commit comments

Comments
 (0)