mirror/opustags
1
0
Fork 0
mirror of https://github.com/fmang/opustags.git synced 2024-11-13 00:42:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

ogg: test a malicious tags packet

Browse Source
This commit is contained in:
Frédéric Mangano 2016-03-03 13:21:24 +01:00 committed by Frédéric Mangano
parent a78906a8d4
commit d21517de94
1 changed files with 54 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
tests/ogg_test.cc
View File

@ -80,5 +80,59 @@ TEST_CASE("decoding a multi-stream file", "[ogg]")
REQUIRE(s->state == ogg::TAGS_READY);
}
void craft_stream(std::ostream &out, const std::string &tags_data)
{
ogg::Encoder enc(out);
ogg_stream_state os;
ogg_page og;
ogg_packet op;
ogg_stream_init(&os, 0);
op.packet = reinterpret_cast<unsigned char*>(const_cast<char*>("OpusHead"));
op.bytes = 8;
op.b_o_s = 1;
op.e_o_s = 0;
op.granulepos = 0;
op.packetno = 0;
ogg_stream_packetin(&os, &op);
ogg_stream_flush(&os, &og);
enc.write_raw_page(og);
op.packet = reinterpret_cast<unsigned char*>(const_cast<char*>(tags_data.data()));
op.bytes = tags_data.size();
op.b_o_s = 0;
op.e_o_s = 1;
op.granulepos = 0;
op.packetno = 1;
ogg_stream_packetin(&os, &op);
ogg_stream_flush(&os, &og);
enc.write_raw_page(og);
ogg_stream_clear(&os);
}
const char *evil_tags =
"OpusTags"
"\x00\x00\x00\x00" "" /* vendor */
"\x01\x00\x00\x00" /* one comment */
"\xFA\x00\x00\x00" "TITLE=Evil"
/* ^ should be \x0A as the length of the comment is 10 */
;
TEST_CASE("decoding a malicious Ogg Opus file", "[ogg]")
{
std::stringstream buf;
craft_stream(buf, std::string(evil_tags, 8 + 4 + 4 + 4 + 10));
buf.seekg(0, buf.beg);
ogg::Decoder dec(buf);
std::shared_ptr<ogg::Stream> s = dec.read_page();
REQUIRE(s != nullptr);
REQUIRE(s->state == ogg::HEADER_READY);
REQUIRE(s->type == ogg::OPUS_STREAM);
REQUIRE_THROWS(dec.read_page());
}
// Encoding is trickier, and might as well be done in actions_test.cc, given
// opustags::edit_tags covers all of Encoder's regular code.