Skip to content

flacparse: Avoid integer overflow in available data check for image tags

Tim-Philipp Müller requested to merge tpm/gstreamer:flacparse-tags into main

If the image length as stored in the file is some bogus integer then adding it to the current byte readers position can overflow and wrongly have the check for enough available data succeed.

This then later can cause NULL pointer dereferences or out of bounds reads/writes when actually reading the image data.

Fixes ZDI-CAN-20775 Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2661

Merge request reports