Milan Kyselica 2f38860a5a format_ogg_speex: Add bounds check to prevent heap buffer overflow ...

The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.

Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().

Resolves: #GHSA-8jhw-m2hg-vp3h

2026-06-25 08:21:35 -06:00

..

format_g719.c

Remove as much trailing whitespace as possible.

2017-12-22 09:23:22 -05:00

format_g723.c

Remove as much trailing whitespace as possible.

2017-12-22 09:23:22 -05:00

format_g726.c

various files - fix some alerts raised by lgtm code analysis

2019-11-18 08:30:45 -06:00

format_g729.c

Remove as much trailing whitespace as possible.

2017-12-22 09:23:22 -05:00

format_gsm.c

format_gsm.c: Added mime type

2024-12-10 13:25:02 +00:00

format_h263.c

Remove as much trailing whitespace as possible.

2017-12-22 09:23:22 -05:00

format_h264.c

Remove as much trailing whitespace as possible.

2017-12-22 09:23:22 -05:00

format_ilbc.c

Remove as much trailing whitespace as possible.

2017-12-22 09:23:22 -05:00

format_ogg_speex.c

format_ogg_speex: Add bounds check to prevent heap buffer overflow

2026-06-25 08:21:35 -06:00

format_ogg_vorbis.c

formats: Spelling fixes

2021-11-16 06:01:45 -06:00

format_pcm.c

Add the ability to read the media file type from HTTP header for playback

2018-04-30 16:30:44 -04:00

format_siren7.c

Remove as much trailing whitespace as possible.

2017-12-22 09:23:22 -05:00

format_siren14.c

Remove as much trailing whitespace as possible.

2017-12-22 09:23:22 -05:00

format_sln.c

format_sln: add .slin as supported file extension

2023-03-16 12:46:42 -06:00

format_vox.c

Add the ability to read the media file type from HTTP header for playback

2018-04-30 16:30:44 -04:00

format_wav_gsm.c

Remove as much trailing whitespace as possible.

2017-12-22 09:23:22 -05:00

format_wav.c

format_wav: replace ast_log(LOG_DEBUG, ...) by ast_debug(1, ...)

2023-01-10 13:32:49 -06:00

Makefile

Remove as much trailing whitespace as possible.

2017-12-22 09:23:22 -05:00

msgsm.h

various files - fix some alerts raised by lgtm code analysis

2019-11-18 08:30:45 -06:00