From 0a7b294d33bef227fe747fe11ee6650bb86e197e Mon Sep 17 00:00:00 2001 From: Martijn van Beurden Date: Fri, 27 Dec 2024 08:42:31 +0100 Subject: [PATCH] Check for overflow in off_t when parsing chunks Credit: Oss-Fuzz Issue: https://issues.oss-fuzz.com/issues/42537590 --- include/share/compat.h | 2 +- src/flac/encode.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/include/share/compat.h b/include/share/compat.h index 06de761c7a..67be5255f5 100644 --- a/include/share/compat.h +++ b/include/share/compat.h @@ -70,7 +70,7 @@ #define FLAC__OFF_T_MAX LONG_MAX #else #define FLAC__off_t off_t -#define FLAC__OFF_T_MAX OFF_T_MAX +#define FLAC__OFF_T_MAX (sizeof(off_t) == sizeof(int64_t) ? INT64_MAX : sizeof(off_t) == sizeof(int32_t) ? INT32_MAX : -999999) #endif #endif diff --git a/src/flac/encode.c b/src/flac/encode.c index ece960640c..18ea9758b1 100644 --- a/src/flac/encode.c +++ b/src/flac/encode.c @@ -2915,6 +2915,9 @@ FLAC__bool fskip_ahead(FILE *f, FLAC__uint64 offset) static uint8_t dump[8192]; struct flac_stat_s stb; + if(offset > (FLAC__uint64)FLAC__OFF_T_MAX) + return false; + if(flac_fstat(fileno(f), &stb) == 0 && (stb.st_mode & S_IFMT) == S_IFREG) { if(fseeko(f, offset, SEEK_CUR) == 0)