Check that blocksize is evenly divisible by 2^(partition order)

Credit: Oss-Fuzz
Issue: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38815

Signed-off-by: Ralph Giles <giles@thaumas.net>
This commit is contained in:
Martijn van Beurden 2022-01-11 20:31:59 +01:00 committed by Ralph Giles
parent 2f209573d0
commit 79e462fb61
No known key found for this signature in database
GPG Key ID: 9259A8F2D2D44C84
1 changed files with 4 additions and 2 deletions

View File

@ -2625,7 +2625,8 @@ FLAC__bool read_subframe_fixed_(FLAC__StreamDecoder *decoder, uint32_t channel,
case FLAC__ENTROPY_CODING_METHOD_PARTITIONED_RICE2:
if(!FLAC__bitreader_read_raw_uint32(decoder->private_->input, &u32, FLAC__ENTROPY_CODING_METHOD_PARTITIONED_RICE_ORDER_LEN))
return false; /* read_callback_ sets the state for us */
if(decoder->private_->frame.header.blocksize >> u32 < order) {
if((decoder->private_->frame.header.blocksize >> u32 < order) ||
(decoder->private_->frame.header.blocksize % (1 << u32) > 0)) {
send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC);
decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC;
return true;
@ -2714,7 +2715,8 @@ FLAC__bool read_subframe_lpc_(FLAC__StreamDecoder *decoder, uint32_t channel, ui
case FLAC__ENTROPY_CODING_METHOD_PARTITIONED_RICE2:
if(!FLAC__bitreader_read_raw_uint32(decoder->private_->input, &u32, FLAC__ENTROPY_CODING_METHOD_PARTITIONED_RICE_ORDER_LEN))
return false; /* read_callback_ sets the state for us */
if(decoder->private_->frame.header.blocksize >> u32 < order) {
if((decoder->private_->frame.header.blocksize >> u32 < order) ||
(decoder->private_->frame.header.blocksize % (1 << u32) > 0)) {
send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC);
decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC;
return true;