Skip to content

Commit db7b34c

Browse files
committed
Change check for overflow so sanitizer doesn't trigger
Credit: Oss-fuzz Issue: https://issues.oss-fuzz.com/issues/482309612
1 parent 9d23884 commit db7b34c

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

src/flac/foreign_metadata.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,7 @@ static FLAC__bool read_from_wave_(foreign_metadata_t *fm, FILE *f, const char **
211211
{
212212
FLAC__byte buffer[12];
213213
FLAC__off_t offset, eof_offset = -1, ds64_data_size = -1;
214+
FLAC__uint64 overflow_check;
214215
if((offset = ftello(f)) < 0) {
215216
if(error) *error = "ftello() error (001)";
216217
return false;
@@ -314,12 +315,13 @@ static FLAC__bool read_from_wave_(foreign_metadata_t *fm, FILE *f, const char **
314315
if(error) *error = "RF64 file has \"ds64\" chunk with extra size table, which is not currently supported (r06)";
315316
return false;
316317
}
317-
eof_offset = (FLAC__off_t)8 + (FLAC__off_t)unpack64le_(buffer2);
318+
overflow_check = 8 + unpack64le_(buffer2);
318319
/* @@@ [2^63 limit] */
319-
if((FLAC__off_t)unpack64le_(buffer2) < 0 || eof_offset < 0) {
320+
if(overflow_check > FLAC__OFF_T_MAX) {
320321
if(error) *error = "RF64 file too large (r07)";
321322
return false;
322323
}
324+
eof_offset = (FLAC__off_t)overflow_check;
323325
}
324326
else { /* skip to next chunk */
325327
if(fm->is_rf64 && !memcmp(buffer, "data", 4) && unpack32le_(buffer+4) == 0xffffffff) {

0 commit comments

Comments
 (0)