From 68745685f49814d049caf12da6589104d9a86995 Mon Sep 17 00:00:00 2001 From: WeebDataHoarder <57538841+WeebDataHoarder@users.noreply.github.com> Date: Fri, 22 Apr 2022 18:32:38 +0200 Subject: [PATCH] Enforce numSamples to be lesser than max frame length on decode, security issue --- codec/ALACDecoder.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/codec/ALACDecoder.cpp b/codec/ALACDecoder.cpp index ce3340d..14fec70 100644 --- a/codec/ALACDecoder.cpp +++ b/codec/ALACDecoder.cpp @@ -251,6 +251,8 @@ int32_t ALACDecoder::Decode( BitBuffer * bits, uint8_t * sampleBuffer, uint32_t { numSamples = BitBufferRead( bits, 16 ) << 16; numSamples |= BitBufferRead( bits, 16 ); + + RequireAction( numSamples <= mConfig.frameLength, status = kALAC_ParamError; goto Exit; ); } if ( escapeFlag == 0 ) @@ -402,6 +404,8 @@ int32_t ALACDecoder::Decode( BitBuffer * bits, uint8_t * sampleBuffer, uint32_t { numSamples = BitBufferRead( bits, 16 ) << 16; numSamples |= BitBufferRead( bits, 16 ); + + RequireAction( numSamples <= mConfig.frameLength, status = kALAC_ParamError; goto Exit; ); } if ( escapeFlag == 0 )