[PATCH] fixed #2364

Gbp-Pq: Name CVE-2023-23144.patch

diff --git a/src/bifs/unquantize.c b/src/bifs/unquantize.c
index a4bfcbfbb91a141ad655a419ff62ec2789d0d8fe..160e9fe632de232b60fae914246d180983144ba8 100644 (file)
--- a/src/bifs/unquantize.c
+++ b/src/bifs/unquantize.c
@@ -2,7 +2,7 @@
  *                     GPAC - Multimedia Framework C SDK
  *
  *                     Authors: Jean Le Feuvre
- *                     Copyright (c) Telecom ParisTech 2000-2012
+ *                     Copyright (c) Telecom ParisTech 2000-2023
  *                                     All rights reserved
  *
  *  This file is part of GPAC / BIFS codec sub-project
@@ -284,7 +284,7 @@ GF_Err Q_DecCoordOnUnitSphere(GF_BifsDecoder *codec, GF_BitStream *bs, u32 NbBit
        s32 value;
        Fixed tang[4], delta;
        s32 dir;
-
+       if (NbBits>32) return GF_NON_COMPLIANT_BITSTREAM;
        if (NbComp != 2 && NbComp != 3) return GF_BAD_PARAM;
 
        //only 2 or 3 comp in the quantized version