fix: MLLT carry subtraction overflow

polyfloyd · Dec 26, 2024 · 64d7c90 · 64d7c90
1 parent f313182
commit 64d7c90
Showing 1 changed file with 43 additions and 1 deletion.
diff --git a/src/stream/frame/content.rs b/src/stream/frame/content.rs
@@ -870,7 +870,10 @@ impl<'a> Decoder<'a> {
                 .by_ref()
                 .take((bits_for_bytes_us + bits_for_millis_us) / 8)
             {
-                carry |= u64::from(b) << (64 - carry_bits - 8);
+                carry |= u64::from(b)
+                    << (64_usize.checked_sub(carry_bits + 8_usize).ok_or_else(|| {
+                        Error::new(ErrorKind::InvalidInput, "MLLT carry subtraction overflow")
+                    })?);
                 carry_bits += 8;
             }
             // Shift 2 deviation fields from the carry accumulator.
@@ -1944,4 +1947,43 @@ mod tests {
             assert_eq!(e.description, "MLLT carry overflow");
         }
     }
+
+    #[test]
+    fn test_mllt_subtract_overflow() {
+        // Create a payload with large deviation values that would cause an overflow
+        let payload = [
+            0xBC, 0xBC, // frames_between_reference (48316)
+            0xBC, 0xBC, 0xBC, // bytes_between_reference (12369084)
+            0xBC, 0xBC, 0xBC, // millis_between_reference (12369084)
+            0xBC, // bits_for_bytes (118)
+            0xBC, // bits_for_millis (118)
+            0x62, 0x62, 0x63, 0x00, 0x3B, 0x00, 0x65, 0x62, 0x62, 0x7A, 0x62, 0x62, 0xFF, 0x42,
+            0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
+            0x42, 0x42, 0x42, 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xBC, 0xBC, 0xBC, 0xBC, 0xBC, 0xBC, 0xBC, 0x62, 0x62, 0x63, 0x00, 0x3B, 0x00, 0x65,
+            0x62, 0x62, 0x7A, 0x62, 0x62, 0xFF, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42,
+            0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x09,
+            0x00, 0xFF, 0xC1, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x3F, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0x62, 0xFF, 0x39, 0x00, 0xD3, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0xEA,
+        ];
+
+        // Combine header and payload into a single data stream
+        let mut data = Vec::new();
+        data.extend_from_slice(&payload);
+
+        let mut reader = Cursor::new(data);
+
+        // Attempt to decode the frame
+        let result = decode("MLLT", Version::Id3v23, &mut reader);
+
+        // Ensure that the result is an error due to overflow
+        assert!(result.is_err());
+        if let Err(e) = result {
+            assert!(matches!(e.kind, ErrorKind::InvalidInput));
+            assert_eq!(e.description, "MLLT carry subtraction overflow");
+        }
+    }
 }