commit abb5ff373d7da5e2246f00448efda47727e8cdb1
author Paul B Mahol <onemda@gmail.com> Tue Nov 22 10:27:39 2022
committer Paul B Mahol <onemda@gmail.com> Tue Nov 22 19:51:42 2022
tree 16acdd4aa427bad6a6c62146abf6c5fdcc2d302e
parent 9f5a9a749962e10a98ef040f87817ef1fede3df9

avcodec/bonk: check level value to not reach invalid values

Also reset bitstream parsing variables on fatal error.

libavcodec/bonk.c

diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c
index 2b2e202..4793bf2 100644
--- a/libavcodec/bonk.c
+++ b/libavcodec/bonk.c
@@ -217,6 +217,9 @@
             level += 1 << low_bits;
         }
 
+        if (level > 1 << 15)
+            return AVERROR_INVALIDDATA;
+
         if (x >= max_x)
             return AVERROR_INVALIDDATA;
 
@@ -330,7 +333,7 @@
 
     skip_bits(gb, s->skip);
     if ((ret = intlist_read(s, s->k, s->n_taps, 0)) < 0)
-        return ret;
+        goto fail;
 
     for (int i = 0; i < s->n_taps; i++)
         s->k[i] *= s->quant[i];
@@ -345,7 +348,7 @@
 
         predictor_init_state(s->k, state, s->n_taps);
         if ((ret = intlist_read(s, s->input_samples, samples_per_packet, 1)) < 0)
-            return ret;
+            goto fail;
 
         for (int i = 0; i < samples_per_packet; i++) {
             for (int j = 0; j < s->down_sampling - 1; j++) {
@@ -390,6 +393,7 @@
     n = get_bits_count(gb) / 8;
 
     if (n > buf_size) {
+fail:
         s->bitstream_size = 0;
         s->bitstream_index = 0;
         return AVERROR_INVALIDDATA;