diff options
| author | Martijn van Beurden <mvanb1@gmail.com> | 2022-06-09 13:04:39 +0200 |
|---|---|---|
| committer | Martijn van Beurden <mvanb1@gmail.com> | 2022-06-15 07:46:48 +0200 |
| commit | 12cf4b9c4ef81785af6c3671563c3c1105911e03 (patch) | |
| tree | 4b135874a339bd5ad74f7e3dfeab2665253fa4ed /src | |
| parent | bef0c92d0544226eab553db751d9842a7d3c36cc (diff) | |
| download | flac-12cf4b9c4ef81785af6c3671563c3c1105911e03.tar.gz | |
Fix two timeouts when decoding ogg
Fuzzing found timeouts occuring when processing garbage input with
the decoder trying to decode or seek in it assuming it to be an ogg
stream
Diffstat (limited to 'src')
| -rw-r--r-- | src/libFLAC/stream_decoder.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c index beb1384d..86dc8ae1 100644 --- a/src/libFLAC/stream_decoder.c +++ b/src/libFLAC/stream_decoder.c @@ -893,6 +893,7 @@ FLAC_API FLAC__bool FLAC__stream_decoder_flush(FLAC__StreamDecoder *decoder) decoder->private_->samples_decoded = 0; decoder->private_->do_md5_checking = false; + decoder->private_->last_seen_framesync = 0; #if FLAC__HAS_OGG if(decoder->private_->is_ogg) @@ -2187,7 +2188,7 @@ FLAC__bool read_frame_(FLAC__StreamDecoder *decoder, FLAC__bool *got_a_frame, FL #ifndef NDEBUG fprintf(stderr, "Rewinding, seeking necessary\n"); #endif - if(decoder->private_->seek_callback){ + if(decoder->private_->seek_callback && decoder->private_->last_seen_framesync){ /* Last framesync isn't in bitreader anymore, rewind with seek if possible */ #ifndef NDEBUG FLAC__uint64 current_decode_position; @@ -3481,6 +3482,12 @@ FLAC__bool seek_to_absolute_sample_ogg_(FLAC__StreamDecoder *decoder, FLAC__uint decoder->private_->target_sample = target_sample; for( ; ; iteration++) { + /* Do sanity checks on bounds */ + if(right_pos <= left_pos || right_pos - left_pos < 9) { + /* FLAC frame is at least 9 byte in size */ + decoder->protected_->state = FLAC__STREAM_DECODER_SEEK_ERROR; + return false; + } if (iteration == 0 || this_frame_sample > target_sample || target_sample - this_frame_sample > LINEAR_SEARCH_WITHIN_SAMPLES) { if (iteration >= BINARY_SEARCH_AFTER_ITERATION) { pos = (right_pos + left_pos) / 2; |