[FFmpeg-cvslog] avformat/oggparseflac: check init_get_bits' result

[Paul Arzelier]

ffmpeg | branch: master | Paul Arzelier <paul.arzelier at free.fr> | Tue May 30 23:21:36 2023 +0200| [a9042db1d30483639b3ca610b74a7d43f29ea1a9] | committer: James Almer

avformat/oggparseflac: check init_get_bits' result

Check init_get_bits' result for NULL, to avoid dereferencing a NULL
pointer later (CWE-476).
Without this, a segfault happens when trying to decode a handcrafted
ogg-flac file with an absurdly long (e.g. 268435455 bytes) ogg header.

Co-authored-by: James Almer <jamrial at gmail.com>
Signed-off-by: Paul Arzelier <paul.arzelier at free.fr>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a9042db1d30483639b3ca610b74a7d43f29ea1a9
---

 libavformat/oggparseflac.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavformat/oggparseflac.c b/libavformat/oggparseflac.c
index eef6e09927..557440d94b 100644
--- a/libavformat/oggparseflac.c
+++ b/libavformat/oggparseflac.c
@@ -40,7 +40,10 @@ flac_header (AVFormatContext * s, int idx)
     if (os->buf[os->pstart] == 0xff)
         return 0;
 
-    init_get_bits(&gb, os->buf + os->pstart, os->psize*8);
+    ret = init_get_bits8(&gb, os->buf + os->pstart, os->psize);
+    if (ret < 0)
+        return ret;
+
     skip_bits1(&gb); /* metadata_last */
     mdt = get_bits(&gb, 7);