diff --git a/src/subframe.rs b/src/subframe.rs index c8463e4..cd82216 100644 --- a/src/subframe.rs +++ b/src/subframe.rs @@ -583,6 +583,13 @@ fn decode_lpc(input: &mut Bitstream, // The order minus one fits in 5 bits, so the order is at most 32. debug_assert!(order <= 32); + // On the frame decoding level it is ensured that the buffer is large + // enough. If it can't even fit the warm-up samples, then there is a frame + // smaller than its lpc order, which is invalid. + if buffer.len() < order as usize { + return fmt_err("invalid subframe, buffer is too small for given lpc order") + } + // There are order * bits per sample unencoded warm-up sample bits. try!(decode_verbatim(input, bps, &mut buffer[..order as usize])); diff --git a/testsamples/fuzz/5b004788ba05db06d0f6cc8a7a43e334c9d31c44.flac b/testsamples/fuzz/5b004788ba05db06d0f6cc8a7a43e334c9d31c44.flac new file mode 100644 index 0000000..e501bab Binary files /dev/null and b/testsamples/fuzz/5b004788ba05db06d0f6cc8a7a43e334c9d31c44.flac differ