diff options
| author | Martijn van Beurden <mvanb1@gmail.com> | 2022-08-20 13:28:07 +0200 |
|---|---|---|
| committer | Martijn van Beurden <mvanb1@gmail.com> | 2022-08-20 16:03:53 +0200 |
| commit | c90b3ea3c001785389b2f708621ba1e548276e3e (patch) | |
| tree | 047ac667541395b8a0f8900bc4f859e3625e2d55 | |
| parent | 5bc582b2c72a5fe401511ee492d1410f4f23ec7e (diff) | |
| download | flac-c90b3ea3c001785389b2f708621ba1e548276e3e.tar.gz | |
Fix integer overflow in seeking code
This issue popped up in ci-fuzz, unrelated to the PR itself.
| -rw-r--r-- | src/libFLAC/stream_decoder.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c index c8e3f325..ac96c02f 100644 --- a/src/libFLAC/stream_decoder.c +++ b/src/libFLAC/stream_decoder.c @@ -3327,8 +3327,7 @@ FLAC__bool seek_to_absolute_sample_(FLAC__StreamDecoder *decoder, FLAC__uint64 s seek_table->points[i].sample_number != FLAC__STREAM_METADATA_SEEKPOINT_PLACEHOLDER && seek_table->points[i].frame_samples > 0 && /* defense against bad seekpoints */ (total_samples <= 0 || seek_table->points[i].sample_number < total_samples) && /* defense against bad seekpoints */ - seek_table->points[i].sample_number > target_sample && - seek_table->points[i].stream_offset < (FLAC__uint64)INT64_MAX + seek_table->points[i].sample_number > target_sample ) break; } @@ -3366,7 +3365,9 @@ FLAC__bool seek_to_absolute_sample_(FLAC__StreamDecoder *decoder, FLAC__uint64 s decoder->protected_->state == FLAC__STREAM_DECODER_ABORTED) return false; /* check if the bounds are still ok */ - if (lower_bound_sample >= upper_bound_sample || lower_bound > upper_bound) { + if (lower_bound_sample >= upper_bound_sample || + lower_bound > upper_bound || + upper_bound >= INT64_MAX) { decoder->protected_->state = FLAC__STREAM_DECODER_SEEK_ERROR; return false; } |