diff options
| author | Sebastian Dröge <sebastian@centricular.com> | 2024-04-01 14:36:19 +0300 |
|---|---|---|
| committer | GStreamer Marge Bot <gitlab-merge-bot@gstreamer-foundation.org> | 2024-04-08 09:34:12 +0000 |
| commit | 6953204a9c33130ccbbcb426f3ba274e921cf949 (patch) | |
| tree | 9ce7351b5267dd2fe526ec773bde8d6b5c494c85 | |
| parent | 18548cdd761594542dbf1bd34f92fb675d9b158e (diff) | |
wavpackparse: Fix potential integer overflow on ID_ODD_SIZE blocks
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/6564>
| -rw-r--r-- | subprojects/gst-plugins-good/gst/audioparsers/gstwavpackparse.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/subprojects/gst-plugins-good/gst/audioparsers/gstwavpackparse.c b/subprojects/gst-plugins-good/gst/audioparsers/gstwavpackparse.c index 5e5abeb6e1..917ea2be52 100644 --- a/subprojects/gst-plugins-good/gst/audioparsers/gstwavpackparse.c +++ b/subprojects/gst-plugins-good/gst/audioparsers/gstwavpackparse.c @@ -322,8 +322,11 @@ gst_wavpack_parse_frame_metadata (GstWavpackParse * parse, GstBuffer * buf, size <<= 8; size += c; size <<= 1; - if (id & ID_ODD_SIZE) + if (id & ID_ODD_SIZE) { + if (size == 0) + goto read_failed; size--; + } CHECK (gst_byte_reader_get_data (&br, size + (size & 1), &data)); gst_byte_reader_init (&mbr, data, size); |