RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 15:47:35 +00:00
Code Issues Activity Actions

LibAudio: Check that LPC order is smaller than subframe sample count

Browse source 
An LPC predictor (fixed or not) contains as many warm-up samples as its
order. Therefore, the corresponding subframe must have at least this
many samples.

This turns this fuzzer-found crash into a handleable format error.
This commit is contained in:
kleines Filmröllchen 2023-06-27 20:25:57 +02:00 • committed by Jelle Raaijmakers
parent 0487a841c3
commit 2e9e0dfe61
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Userland/Libraries/LibAudio/FlacLoader.cpp
View file

@ -724,6 +724,10 @@ ErrorOr<Vector<i32>, LoaderError> FlacLoaderPlugin::decode_verbatim(FlacSubframe
// Decode a subframe encoded with a custom linear predictor coding, i.e. the subframe provides the polynomial order and coefficients
ErrorOr<Vector<i32>, LoaderError> FlacLoaderPlugin::decode_custom_lpc(FlacSubframeHeader& subframe, BigEndianInputBitStream& bit_input)
{
// LPC must provide at least as many samples as its order.
if (subframe.order > m_current_frame->sample_count)
return LoaderError { LoaderError::Category::Format, static_cast<size_t>(m_current_sample_or_frame), "Too small frame for LPC order" };
Vector<i32> decoded;
decoded.ensure_capacity(m_current_frame->sample_count);
@ -779,6 +783,10 @@ ErrorOr<Vector<i32>, LoaderError> FlacLoaderPlugin::decode_custom_lpc(FlacSubfra
// Decode a subframe encoded with one of the fixed linear predictor codings
ErrorOr<Vector<i32>, LoaderError> FlacLoaderPlugin::decode_fixed_lpc(FlacSubframeHeader& subframe, BigEndianInputBitStream& bit_input)
{
// LPC must provide at least as many samples as its order.
if (subframe.order > m_current_frame->sample_count)
return LoaderError { LoaderError::Category::Format, static_cast<size_t>(m_current_sample_or_frame), "Too small frame for LPC order" };
Vector<i32> decoded;
decoded.ensure_capacity(m_current_frame->sample_count);