From fdd3e3504eba150c3e47aee42743cb0f3226ca6a Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Fri, 19 Jul 2024 00:00:43 -0300
Subject: [PATCH] avformat/iamf_parse: sanitize audio_roll_distance values

Ensure the values are spec complaint and that no integer overflow can happen.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 9ce065c90decf1a07a810ccb699a491d41a720d2)
---
 libavformat/iamf_parse.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 4ac3454f41..0d80e6e725 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -38,7 +38,7 @@ static int opus_decoder_config(IAMFCodecConfig *codec_config,
 {
     int left = len - avio_tell(pb);
 
-    if (left < 11)
+    if (left < 11 || codec_config->audio_roll_distance >= 0)
         return AVERROR_INVALIDDATA;
 
     codec_config->extradata = av_malloc(left + 8);
@@ -64,6 +64,9 @@ static int aac_decoder_config(IAMFCodecConfig *codec_config,
     int object_type_id, codec_id, stream_type;
     int ret, tag, left;
 
+    if (codec_config->audio_roll_distance >= 0)
+        return AVERROR_INVALIDDATA;
+
     tag = avio_r8(pb);
     if (tag != MP4DecConfigDescrTag)
         return AVERROR_INVALIDDATA;
@@ -118,6 +121,9 @@ static int flac_decoder_config(IAMFCodecConfig *codec_config,
 {
     int left;
 
+    if (codec_config->audio_roll_distance)
+        return AVERROR_INVALIDDATA;
+
     avio_skip(pb, 4); // METADATA_BLOCK_HEADER
 
     left = len - avio_tell(pb);
@@ -146,7 +152,7 @@ static int ipcm_decoder_config(IAMFCodecConfig *codec_config,
     };
     int sample_format = avio_r8(pb); // 0 = BE, 1 = LE
     int sample_size = (avio_r8(pb) / 8 - 2); // 16, 24, 32
-    if (sample_format > 1 || sample_size > 2)
+    if (sample_format > 1 || sample_size > 2 || codec_config->audio_roll_distance)
         return AVERROR_INVALIDDATA;
 
     codec_config->codec_id = sample_fmt[sample_format][sample_size];
@@ -246,6 +252,12 @@ static int codec_config_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
     if (ret < 0)
         goto fail;
 
+    if ((codec_config->nb_samples > INT_MAX) ||
+        (-codec_config->audio_roll_distance > INT_MAX / codec_config->nb_samples)) {
+        ret = AVERROR_INVALIDDATA;
+        goto fail;
+    }
+
     c->codec_configs[c->nb_codec_configs++] = codec_config;
 
     len -= avio_tell(pbc);