Forráskód Böngészése

LibAudio: Check that LPC order is smaller than subframe sample count

An LPC predictor (fixed or not) contains as many warm-up samples as its
order. Therefore, the corresponding subframe must have at least this
many samples.

This turns this fuzzer-found crash into a handleable format error.
kleines Filmröllchen 2 éve
szülő
commit
2e9e0dfe61
1 módosított fájl, 8 hozzáadás és 0 törlés
  1. 8 0
      Userland/Libraries/LibAudio/FlacLoader.cpp

+ 8 - 0
Userland/Libraries/LibAudio/FlacLoader.cpp

@@ -724,6 +724,10 @@ ErrorOr<Vector<i32>, LoaderError> FlacLoaderPlugin::decode_verbatim(FlacSubframe
 // Decode a subframe encoded with a custom linear predictor coding, i.e. the subframe provides the polynomial order and coefficients
 ErrorOr<Vector<i32>, LoaderError> FlacLoaderPlugin::decode_custom_lpc(FlacSubframeHeader& subframe, BigEndianInputBitStream& bit_input)
 {
+    // LPC must provide at least as many samples as its order.
+    if (subframe.order > m_current_frame->sample_count)
+        return LoaderError { LoaderError::Category::Format, static_cast<size_t>(m_current_sample_or_frame), "Too small frame for LPC order" };
+
     Vector<i32> decoded;
     decoded.ensure_capacity(m_current_frame->sample_count);
 
@@ -779,6 +783,10 @@ ErrorOr<Vector<i32>, LoaderError> FlacLoaderPlugin::decode_custom_lpc(FlacSubfra
 // Decode a subframe encoded with one of the fixed linear predictor codings
 ErrorOr<Vector<i32>, LoaderError> FlacLoaderPlugin::decode_fixed_lpc(FlacSubframeHeader& subframe, BigEndianInputBitStream& bit_input)
 {
+    // LPC must provide at least as many samples as its order.
+    if (subframe.order > m_current_frame->sample_count)
+        return LoaderError { LoaderError::Category::Format, static_cast<size_t>(m_current_sample_or_frame), "Too small frame for LPC order" };
+
     Vector<i32> decoded;
     decoded.ensure_capacity(m_current_frame->sample_count);