From 0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c Mon Sep 17 00:00:00 2001 From: James Almer Date: Sat, 17 Feb 2024 09:45:57 -0300 Subject: [PATCH] avcodec/speexdec: further check for sane frame_size values Prevent potential integer overflows. Signed-off-by: James Almer --- libavcodec/speexdec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c index 08c7e77..46d2587 100644 --- a/libavcodec/speexdec.c +++ b/libavcodec/speexdec.c @@ -1420,8 +1420,10 @@ static int parse_speex_extradata(AVCodecContext *avctx, return AVERROR_INVALIDDATA; s->bitrate = bytestream_get_le32(&buf); s->frame_size = bytestream_get_le32(&buf); - if (s->frame_size < NB_FRAME_SIZE << s->mode) + if (s->frame_size < NB_FRAME_SIZE << s->mode || + s->frame_size > INT32_MAX >> s->mode) return AVERROR_INVALIDDATA; + s->frame_size <<= s->mode; s->vbr = bytestream_get_le32(&buf); s->frames_per_packet = bytestream_get_le32(&buf); if (s->frames_per_packet <= 0 || -- 2.33.0