commit d68164e6f398b9a1420ad2c5b3a45e241931d2cf
author Edward Hervey <edward@centricular.com> Wed May 30 10:56:12 2018 +0200
committer Tim-Philipp Müller <tim@centricular.com> Wed Jul 18 14:24:28 2018 +0100
tree 7e555f74f719d45404ed93352887611d01bdd947
parent 20450822ab00d09586e6acf1d3a773456df90d0a

ogg: Avoid undefined granule shift

A granule is a 64bit signed integer, shifting by 63 or more is
undefined and most likely an indication that the stream is
corrupted or invalid.

Detected by oss-fuzz

ext/ogg/gstoggstream.c

diff --git a/ext/ogg/gstoggstream.c b/ext/ogg/gstoggstream.c
index 25b880f..ff69cc3 100644
--- a/ext/ogg/gstoggstream.c
+++ b/ext/ogg/gstoggstream.c
@@ -434,6 +434,11 @@
   /* 2 bits + 3 bits = 5 bits KFGSHIFT */
   pad->granuleshift = ((GST_READ_UINT8 (data + 40) & 0x03) << 3) +
       (GST_READ_UINT8 (data + 41) >> 5);
+  if (pad->granuleshift >= 63) {
+    /* Granuleshift can't be greater than the storage size of a granule */
+    GST_WARNING ("Invalid granuleshift (%u >= 63)", pad->granuleshift);
+    return FALSE;
+  }
   GST_LOG ("granshift: %d", pad->granuleshift);
 
   pad->is_video = TRUE;
@@ -1335,6 +1340,11 @@
   }
   if (pad->granuleshift == G_MAXUINT32) {
     pad->granuleshift = GST_READ_UINT8 (data + 28);
+    if (pad->granuleshift >= 63) {
+      /* Granuleshift can't be greater than the storage size of a granule */
+      GST_WARNING ("Invalid granuleshift (%u >= 63)", pad->granuleshift);
+      return FALSE;
+    }
   }
 
   start_granule = GST_READ_UINT64_LE (data + 16);
@@ -1838,6 +1848,11 @@
   pad->granulerate_n = GST_READ_UINT64_LE (data + 12);
   pad->granulerate_d = GST_READ_UINT64_LE (data + 20);
   pad->granuleshift = data[28];
+  if (pad->granuleshift >= 63) {
+    /* Granuleshift can't be greater than the storage size of a granule */
+    GST_WARNING ("Invalid granuleshift (%u >= 63)", pad->granuleshift);
+    return FALSE;
+  }
   GST_LOG ("sample rate: %d", pad->granulerate_n);
 
   pad->n_header_packets = 3;
@@ -1895,6 +1910,11 @@
   pad->granulerate_n = GST_READ_UINT32_LE (data + 24);
   pad->granulerate_d = GST_READ_UINT32_LE (data + 28);
   pad->granuleshift = GST_READ_UINT8 (data + 15);
+  if (pad->granuleshift >= 63) {
+    /* Granuleshift can't be greater than the storage size of a granule */
+    GST_WARNING ("Invalid granuleshift (%u >= 63)", pad->granuleshift);
+    return FALSE;
+  }
   GST_LOG ("sample rate: %d", pad->granulerate_n);
 
   pad->n_header_packets = GST_READ_UINT8 (data + 11);
@@ -2155,6 +2175,11 @@
       h);
 
   pad->granuleshift = GST_READ_UINT8 (data + 37);
+  if (pad->granuleshift >= 63) {
+    /* Granuleshift can't be greater than the storage size of a granule */
+    GST_WARNING ("Invalid granuleshift (%u >= 63)", pad->granuleshift);
+    return FALSE;
+  }
   GST_LOG ("granshift: %d", pad->granuleshift);
 
   pad->is_video = TRUE;