[PATCH] adpcmdec: Fail negotiation if block_align is not provided

From dbc19dcbb0d16484ec77e8ba1ec590b71d286570 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Mon, 3 Aug 2026 12:30:45 +0300
Subject: [PATCH] adpcmdec: Fix IMA ADPCM input size check to match with the
 actual code

Gbp-Pq: Name CVE-2026-19387.patch

diff --git a/gst/adpcmdec/adpcmdec.c b/gst/adpcmdec/adpcmdec.c
index fb25ca5af4144357dee92e6d8fa40af763fdd92e..4cc6aeedad2e29e656dffd721ea4fa9f46e84b53 100644 (file)
--- a/gst/adpcmdec/adpcmdec.c
+++ b/gst/adpcmdec/adpcmdec.c
@@ -108,7 +108,7 @@ adpcmdec_set_format (GstAudioDecoder * bdec, GstCaps * in_caps)
     return FALSE;
 
   if (!gst_structure_get_int (structure, "block_align", &dec->blocksize))
-    dec->blocksize = -1;        /* Not provided */
+    return FALSE;
 
   if (!gst_structure_get_int (structure, "rate", &dec->rate))
     return FALSE;
@@ -280,7 +280,7 @@ adpcmdec_decode_ima_block (ADPCMDec * dec, int n_samples, const guint8 * data,
   int i, j;
   int sample;
 
-  if ((n_samples - dec->channels) % 8 != 0) {
+  if ((n_samples - dec->channels) % (8 * dec->channels) != 0) {
     GST_WARNING_OBJECT (dec, "Input not correct size");
     return FALSE;
   }