mirror of
git://git.yoctoproject.org/poky
synced 2026-09-14 04:41:09 +00:00
7b6ce37e5d
(From OE-Core rev: cbe8929662f8ea873a3686517516bc5754a3cd18) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
41 lines
1.4 KiB
Diff
41 lines
1.4 KiB
Diff
From 66b50445cb36cf6adb49c2397362509aedb42c71 Mon Sep 17 00:00:00 2001
|
|
From: James Almer <jamrial@gmail.com>
|
|
Date: Fri, 16 Feb 2024 11:17:13 -0300
|
|
Subject: [PATCH] avcodec/speexdec: check for sane frame_size values
|
|
|
|
Regression since ab39cc36c72bb73318bb911acb66873de850a107.
|
|
|
|
Fixes heap buffer overflows
|
|
Fixes ticket #10866
|
|
|
|
Reported-by: sploitem <sploitem@gmail.com>
|
|
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
|
|
Signed-off-by: James Almer <jamrial@gmail.com>
|
|
|
|
CVE: CVE-2024-28661
|
|
|
|
Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/66b50445cb36cf6adb49c2397362509aedb42c71]
|
|
|
|
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
|
|
---
|
|
libavcodec/speexdec.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c
|
|
index ee95417..5b016df 100644
|
|
--- a/libavcodec/speexdec.c
|
|
+++ b/libavcodec/speexdec.c
|
|
@@ -1419,8 +1419,9 @@ static int parse_speex_extradata(AVCodecContext *avctx,
|
|
return AVERROR_INVALIDDATA;
|
|
s->bitrate = bytestream_get_le32(&buf);
|
|
s->frame_size = bytestream_get_le32(&buf);
|
|
- if (s->frame_size < NB_FRAME_SIZE << s->mode)
|
|
+ if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0))
|
|
return AVERROR_INVALIDDATA;
|
|
+ s->frame_size *= 1 + (s->mode > 0);
|
|
s->vbr = bytestream_get_le32(&buf);
|
|
s->frames_per_packet = bytestream_get_le32(&buf);
|
|
if (s->frames_per_packet <= 0 ||
|
|
--
|
|
2.40.0
|