flacparse: Avoid integer overflow in available data check for image tags
authorSebastian Dröge <sebastian@centricular.com>
Tue, 13 Jun 2023 10:20:16 +0000 (13:20 +0300)
committerTim-Philipp Müller <tim@centricular.com>
Tue, 20 Jun 2023 08:16:37 +0000 (09:16 +0100)
commitbdc8021c73c16c49d594579c606a4f4771a2670e
treec9428834cd397e7e5579b833475be7a9f48d0ed5
parent670ce68f0683c3900bc3534cd91f1b95199621af
flacparse: Avoid integer overflow in available data check for image tags

If the image length as stored in the file is some bogus integer then
adding it to the current byte readers position can overflow and wrongly
have the check for enough available data succeed.

This then later can cause NULL pointer dereferences or out of bounds
reads/writes when actually reading the image data.

Fixes ZDI-CAN-20775
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2661

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/4897>
subprojects/gst-plugins-good/gst/audioparsers/gstflacparse.c