ogg: Fix potential integer overflow
authorHugo Beauzée-Luyssen <hugo@beauzee.fr>
Fri, 26 Jul 2019 11:32:38 +0000 (13:32 +0200)
committerHugo Beauzée-Luyssen <hugo@beauzee.fr>
Wed, 14 Aug 2019 12:03:49 +0000 (14:03 +0200)
modules/demux/ogg.c

index 649e154..3979060 100644 (file)
@@ -2654,7 +2654,8 @@ static bool Ogg_ReadDaalaHeader( logical_stream_t *p_stream,
     oggpack_buffer opb;
     uint32_t i_timebase_numerator;
     uint32_t i_timebase_denominator;
-    int i_keyframe_frequency_force;
+    int keyframe_granule_shift;
+    unsigned int i_keyframe_frequency_force;
     uint8_t i_major;
     uint8_t i_minor;
     uint8_t i_subminor;
@@ -2688,7 +2689,9 @@ static bool Ogg_ReadDaalaHeader( logical_stream_t *p_stream,
 
     oggpack_adv( &opb, 32 ); /* frame duration */
 
-    i_keyframe_frequency_force = 1 << oggpack_read( &opb, 8 );
+    keyframe_granule_shift = oggpack_read( &opb, 8 );
+    keyframe_granule_shift = __MIN(keyframe_granule_shift, 31);
+    i_keyframe_frequency_force = 1u << keyframe_granule_shift;
 
     /* granule_shift = i_log( frequency_force -1 ) */
     p_stream->i_granule_shift = 0;