PR #21547 opened by hassanhany URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21547 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21547.patch
validates the windowtype and transformtype as required by the Vorbis spec in section 4.2.4 the part about modes "verify ranges; zero is the only legal value in Vorbis I for [vorbis_mode_windowtype] and [vorbis_mode_transformtype]." >From bcfd563e25adb1e818b309018b7c03b684668751 Mon Sep 17 00:00:00 2001 From: Hassan Hany <[email protected]> Date: Thu, 22 Jan 2026 15:31:41 +0200 Subject: [PATCH] avcodec/vorbisdec: validate windowtype and transformtype --- libavcodec/vorbisdec.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c index 60a83f394f..1bfebda101 100644 --- a/libavcodec/vorbisdec.c +++ b/libavcodec/vorbisdec.c @@ -908,8 +908,14 @@ static int vorbis_parse_setup_hdr_modes(vorbis_context *vc) vorbis_mode *mode_setup = &vc->modes[i]; mode_setup->blockflag = get_bits1(gb); - mode_setup->windowtype = get_bits(gb, 16); //FIXME check - mode_setup->transformtype = get_bits(gb, 16); //FIXME check + mode_setup->windowtype = get_bits(gb, 16); + mode_setup->transformtype = get_bits(gb, 16); + if (mode_setup->transformtype != 0 || mode_setup->windowtype != 0) { + av_log(vc->avctx, AV_LOG_ERROR, + "Invalid mode: windowtype %u, transformtype %u (both must be 0)\n", + mode_setup->windowtype, mode_setup->transformtype); + return AVERROR_INVALIDDATA; + } GET_VALIDATED_INDEX(mode_setup->mapping, 8, vc->mapping_count); ff_dlog(NULL, " %u mode: blockflag %d, windowtype %d, transformtype %d, mapping %d\n", -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
