beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-30 00:31:14 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

LibAudio: Prevent FLAC Rice partitions getting smaller than 1 sample

Browse source 
This would cause an integer underflow leading to us trying to allocate
over 4GB for residual samples.
This commit is contained in:
kleines Filmröllchen 2023-06-26 15:40:05 +02:00 committed by Jelle Raaijmakers
parent 952c633a65
commit 8bc56c7fb0
Notes: sideshowbarker 2024-07-16 23:57:20 +09:00 
Author: https://github.com/kleinesfilmroellchen
Commit: https://github.com/SerenityOS/serenity/commit/8bc56c7fb0
Pull-request: https://github.com/SerenityOS/serenity/pull/19651
Reviewed-by: https://github.com/Hendiadyoin1
Reviewed-by: https://github.com/gmta ✅
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
Userland/Libraries/LibAudio/FlacLoader.cpp
View file

@ -875,6 +875,9 @@ MaybeLoaderError FlacLoaderPlugin::decode_residual(Vector<i64>& decoded, FlacSub
u8 partition_order = LOADER_TRY(bit_input.read_bits<u8>(4));
size_t partitions = 1 << partition_order;
if (partitions > m_current_frame->sample_count)
return LoaderError { LoaderError::Category::Format, static_cast<size_t>(m_current_sample_or_frame), "Too many Rice partitions, each partition must contain at least one sample" };
if (residual_mode == FlacResidualMode::Rice4Bit) {
// 11.30.2. RESIDUAL_CODING_METHOD_PARTITIONED_EXP_GOLOMB
// decode a single Rice partition with four bits for the order k
@ -907,8 +910,11 @@ ALWAYS_INLINE ErrorOr<Vector<i64>, LoaderError> FlacLoaderPlugin::decode_rice_pa
residual_sample_count = m_current_frame->sample_count - subframe.order;
else
residual_sample_count = m_current_frame->sample_count / partitions;
if (partition_index == 0)
if (partition_index == 0) {
if (subframe.order > residual_sample_count)
return LoaderError { LoaderError::Category::Format, static_cast<size_t>(m_current_sample_or_frame), "First Rice partition must advertise more residuals than LPC order" };
residual_sample_count -= subframe.order;
}
Vector<i64> rice_partition;
rice_partition.resize(residual_sample_count);