Steve Lhomme pushed to branch 3.0.x at VideoLAN / VLC
Commits:
d9a89e48 by Steve Lhomme at 2025-08-21T11:28:37+00:00
demux: wav: check the size of the fmt chunk is legit
WAVEFORMATEX.cbSize represents the size of data after the WAVEFORMATEX
structure [^1].
It is coded on a uint16_t so the size of the WAVEFORMATEX plus its extra data
can never exceed sizeof(WAVEFORMATEX) + UINT16_MAX.
Fixes #29004
[^1]:
https://learn.microsoft.com/en-us/windows/win32/api/mmeapi/ns-mmeapi-waveformatex
(cherry picked from commit d5ab4348ed214174c2f3c50549c7e28acda3b223)
- - - - -
1 changed file:
- modules/demux/wav.c
Changes:
=====================================
modules/demux/wav.c
=====================================
@@ -167,9 +167,9 @@ static int Open( vlc_object_t * p_this )
goto error;
}
i_size += 2;
- if( i_size < sizeof( WAVEFORMATEX ) )
+ if( i_size < sizeof( WAVEFORMATEX ) || i_size > (sizeof( WAVEFORMATEX ) +
UINT16_MAX ) )
{
- msg_Err( p_demux, "invalid 'fmt ' chunk" );
+ msg_Err( p_demux, "invalid 'fmt ' chunk of size %" PRIu32, i_size );
goto error;
}
if( vlc_stream_Read( p_demux->s, NULL, 8 ) != 8 )
View it on GitLab:
https://code.videolan.org/videolan/vlc/-/commit/d9a89e481c13a9a020968673f5fbfb1d9170c8ec
--
View it on GitLab:
https://code.videolan.org/videolan/vlc/-/commit/d9a89e481c13a9a020968673f5fbfb1d9170c8ec
You're receiving this email because of your account on code.videolan.org.
VideoLAN code repository instance_______________________________________________
vlc-commits mailing list
vlc-commits@videolan.org
https://mailman.videolan.org/listinfo/vlc-commits
