[vlc-commits] [Git][videolan/vlc][master] demux: aiff: fix integer overflow in ReadTextChunk

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch master at VideoLAN / VLC


Commits:
19ba8b2c by Amir Mohammad Jahangirzad at 2026-09-08T07:26:25+00:00
demux: aiff: fix integer overflow in ReadTextChunk

i_data_size is a uint32_t read from the file. In malloc(i_data_size + 1),
the addition is computed in 32-bit unsigned arithmetic regardless of
size_t width, since i_data_size's type is not widened before the +1.
When i_data_size == UINT32_MAX, i_data_size + 1 wraps to 0, so malloc(0)
is called, followed by a memcpy of i_data_size bytes.

However it's unreachable because vlc_stream_Peek() uses vlc_frame_Alloc(),
which rejects any allocation over 256 MiB. Still, for robustness it's
better to fix this on both 32-bit and 64-bit.

- - - - -


1 changed file:

- modules/demux/aiff.c


Changes:

=====================================
modules/demux/aiff.c
=====================================
@@ -110,10 +110,8 @@ static int ReadTextChunk( demux_t *p_demux,  uint64_t i_chunk_size, uint32_t i_d
     demux_sys_t *p_sys = p_demux->p_sys;
     const uint8_t *p_peek;
 
-#if UINT32_MAX >= SIZE_MAX
-    if ( i_data_size >= SIZE_MAX )
+    if ( i_data_size >= UINT32_MAX )
         return VLC_ENOMEM;
-#endif
 
     ssize_t ret = vlc_stream_Peek( p_demux->s, &p_peek, i_chunk_size );
     if( ret == -1 || (size_t) ret != i_chunk_size )



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/19ba8b2c5735d1cf669674984f7b3161db824a81

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/19ba8b2c5735d1cf669674984f7b3161db824a81
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help