diff options
| author | Martijn van Beurden <mvanb1@gmail.com> | 2022-01-11 20:31:59 +0100 |
|---|---|---|
| committer | Ralph Giles <giles@thaumas.net> | 2022-02-08 20:49:14 -0800 |
| commit | 79e462fb61c860d4bf69ad00d3c9561fe427d2f6 (patch) | |
| tree | 0d8d79df8fbe5edd1f0885ebce39c20d0af62f3c | |
| parent | 2f209573d0f582385baa00cae45dcf10d50d96c4 (diff) | |
| download | flac-79e462fb61c860d4bf69ad00d3c9561fe427d2f6.tar.gz | |
Check that blocksize is evenly divisible by 2^(partition order)
Credit: Oss-Fuzz
Issue: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38815
Signed-off-by: Ralph Giles <giles@thaumas.net>
| -rw-r--r-- | src/libFLAC/stream_decoder.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c index f1fa8842..4380b486 100644 --- a/src/libFLAC/stream_decoder.c +++ b/src/libFLAC/stream_decoder.c @@ -2625,7 +2625,8 @@ FLAC__bool read_subframe_fixed_(FLAC__StreamDecoder *decoder, uint32_t channel, case FLAC__ENTROPY_CODING_METHOD_PARTITIONED_RICE2: if(!FLAC__bitreader_read_raw_uint32(decoder->private_->input, &u32, FLAC__ENTROPY_CODING_METHOD_PARTITIONED_RICE_ORDER_LEN)) return false; /* read_callback_ sets the state for us */ - if(decoder->private_->frame.header.blocksize >> u32 < order) { + if((decoder->private_->frame.header.blocksize >> u32 < order) || + (decoder->private_->frame.header.blocksize % (1 << u32) > 0)) { send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC); decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC; return true; @@ -2714,7 +2715,8 @@ FLAC__bool read_subframe_lpc_(FLAC__StreamDecoder *decoder, uint32_t channel, ui case FLAC__ENTROPY_CODING_METHOD_PARTITIONED_RICE2: if(!FLAC__bitreader_read_raw_uint32(decoder->private_->input, &u32, FLAC__ENTROPY_CODING_METHOD_PARTITIONED_RICE_ORDER_LEN)) return false; /* read_callback_ sets the state for us */ - if(decoder->private_->frame.header.blocksize >> u32 < order) { + if((decoder->private_->frame.header.blocksize >> u32 < order) || + (decoder->private_->frame.header.blocksize % (1 << u32) > 0)) { send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC); decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC; return true; |