diff options
| author | Martijn van Beurden <mvanb1@gmail.com> | 2022-06-16 16:57:14 +0200 |
|---|---|---|
| committer | Martijn van Beurden <mvanb1@gmail.com> | 2022-07-07 22:06:14 +0200 |
| commit | f3864bf1f65bed9c3006b0ccc9454d39310000d8 (patch) | |
| tree | 71ede3145dfd6aedc73b3e3bb31602c49599de8b /src | |
| parent | da7b9a0cedce262cad49195a6190e152d751a48c (diff) | |
| download | flac-f3864bf1f65bed9c3006b0ccc9454d39310000d8.tar.gz | |
Add limits to metadata reading
In commit 0077d3b checks were added for metadata reading in the
stream decoder. However, the metadata interface suffers from the
same problems. Similar to the mentioned commit, checks are added.
Diffstat (limited to 'src')
| -rw-r--r-- | src/libFLAC/metadata_iterators.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/libFLAC/metadata_iterators.c b/src/libFLAC/metadata_iterators.c index 13dec3c8..b4f1315e 100644 --- a/src/libFLAC/metadata_iterators.c +++ b/src/libFLAC/metadata_iterators.c @@ -2344,6 +2344,11 @@ FLAC__Metadata_SimpleIteratorStatus read_metadata_block_data_vorbis_comment_cb_( if(block->num_comments == 0) { block->comments = 0; } + else if(block->num_comments > (block_length >> 2)) { /* each comment needs at least 4 byte */ + block->num_comments = 0; + status = FLAC__METADATA_SIMPLE_ITERATOR_STATUS_BAD_METADATA; + goto skip; + } else if(0 == (block->comments = calloc(block->num_comments, sizeof(FLAC__StreamMetadata_VorbisComment_Entry)))) { block->num_comments = 0; return FLAC__METADATA_SIMPLE_ITERATOR_STATUS_MEMORY_ALLOCATION_ERROR; @@ -2500,6 +2505,9 @@ static FLAC__Metadata_SimpleIteratorStatus read_metadata_block_data_picture_cstr return FLAC__METADATA_SIMPLE_ITERATOR_STATUS_READ_ERROR; *length = unpack_uint32_(buffer, length_len); + if(*length > (1u << FLAC__STREAM_METADATA_LENGTH_LEN)) /* data cannot be larger than FLAC metadata block */ + return FLAC__METADATA_SIMPLE_ITERATOR_STATUS_BAD_METADATA; + if(0 != *data) free(*data); |