[vlc-commits] [Git][videolan/vlc][3.0.x] 4 commits: demux: ogg: fix headers appending test

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch 3.0.x at VideoLAN / VLC


Commits:
5ab03e85 by François Cartegnie at 2026-08-25T20:23:54+00:00
demux: ogg: fix headers appending test

(cherry picked from commit c36963b7edae5bb7abc8c201197beab2cfcaed4e)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>

- - - - -
524ae201 by François Cartegnie at 2026-08-25T20:23:54+00:00
demux: ogg: check header realloc for overflow

(cherry picked from commit 98af112d53d74ed6c25eb67036e8291f1805285b)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>

- - - - -
97b6813d by Steve Lhomme at 2026-08-25T20:23:54+00:00
demux: ogg: check bytes to use are not negative

Like in the rest of the code.

And fix a sign comparison warning.

(cherry picked from commit 824f09aaf401fcf72ebaabf0b3baa4f3117b4924)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>

- - - - -
b022f272 by Steve Lhomme at 2026-08-25T20:23:54+00:00
demux: ogg: don't use too large speex data

(cherry picked from commit 569992e145194159e49e502afd9c97e4f54a8ca8)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>

- - - - -


1 changed file:

- modules/demux/ogg.c


Changes:

=====================================
modules/demux/ogg.c
=====================================
@@ -1343,7 +1343,8 @@ static void Ogg_DecodePacket( demux_t *p_demux,
         }
 
         /* Backup the ogg packet (likely an header packet) */
-        if( !b_xiph && (p_stream->i_headers + p_oggpacket->bytes) )
+        if( !b_xiph && p_oggpacket->bytes > 0 &&
+            (size_t)p_oggpacket->bytes < SIZE_MAX - p_stream->i_headers )
         {
             uint8_t *p_realloc = realloc( p_stream->p_headers, p_stream->i_headers + p_oggpacket->bytes );
             if( p_realloc )
@@ -1359,7 +1360,8 @@ static void Ogg_DecodePacket( demux_t *p_demux,
                 p_stream->p_headers = NULL;
             }
         }
-        else if( xiph_AppendHeaders( &p_stream->i_headers, &p_stream->p_headers,
+        else if( b_xiph &&
+                 xiph_AppendHeaders( &p_stream->i_headers, &p_stream->p_headers,
                                      p_oggpacket->bytes, p_oggpacket->packet ) )
         {
             free(p_stream->p_headers);
@@ -2830,7 +2832,10 @@ static bool Ogg_ReadSpeexHeader( logical_stream_t *p_stream,
     if ( p_stream->f_rate == 0 ) return false;
     oggpack_adv( &opb, 32 ); /* mode */
     oggpack_adv( &opb, 32 ); /* mode_bitstream_version */
-    p_stream->fmt.audio.i_channels = oggpack_read( &opb, 32 );
+    uint32_t channels = oggpack_read( &opb, 32 );
+    if (channels > UINT8_MAX)
+        return false;
+    p_stream->fmt.audio.i_channels = channels;
     fill_channels_info(&p_stream->fmt.audio);
     p_stream->fmt.i_bitrate = oggpack_read( &opb, 32 );
     p_stream->special.speex.i_framesize =



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/f6c661721ca8b47058f24b213b8f05615a92eadf...b022f27227f15958156ceaefd6c4c087e88cc52f

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/f6c661721ca8b47058f24b213b8f05615a92eadf...b022f27227f15958156ceaefd6c4c087e88cc52f
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help