oss-fuzz: reject page granulepos that will overflow

1 files changed, 15 insertions, 1 deletions

diff --git a/contrib/oss-fuzz/speexdec_fuzzer.cc b/contrib/oss-fuzz/speexdec_fuzzer.cc
index a56a6cd..cc22b90 100644
--- a/contrib/oss-fuzz/speexdec_fuzzer.cc
+++ b/contrib/oss-fuzz/speexdec_fuzzer.cc
@@ -152,6 +152,20 @@ static int is_safe_ogg_page_pageno(const ogg_page *og) {
   return og->header[21] < (1 << 7);
 }
 
+static int is_safe_ogg_page_granulepos(const ogg_page *og){
+  int i;
+  unsigned char *page=og->header;
+  ogg_int64_t granulepos=page[13]&(0xff);
+  for (i = 12; i > 5; i--) {
+    if (granulepos > (INT64_MAX >> 8)) {
+      return 0;
+    }
+    granulepos = (granulepos<<8)|(page[i]&0xff);
+  }
+  return 1;
+}
+
+
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *fuzz_data, size_t fuzz_size)
 {
    output_type output[MAX_FRAME_SIZE];
@@ -216,7 +230,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *fuzz_data, size_t fuzz_size
             ogg_stream_reset_serialno(&os, ogg_page_serialno(&og));
          }
 
-         if (!is_safe_ogg_page_pageno(&og)) {
+         if (!is_safe_ogg_page_pageno(&og) || !is_safe_ogg_page_granulepos(&og)) {
            speex_bits_destroy(&bits);
            ogg_sync_clear(&oy);
            return 0;