<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">2014-12-11 16:31 GMT+01:00 lvqcl <span dir="ltr"><<a href="mailto:lvqcl.mail@gmail.com" target="_blank">lvqcl.mail@gmail.com</a>></span>:<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Martijn van Beurden wrote:<br>
<br>
> For example, it could be checked whether the sample<br>
> rate, blocksize, number of channels and sample size in the frame<br>
> header match with those in the stream info, and whether the<br>
> sample or framenumber is in a sane range. This gives less<br>
> security than fully decoding the frame, but it ensures the seek<br>
> process will no longer fail because of these CVE sanity checks.<br>
<br>
<br>
IIRC flake encoder is able to create FLAC files with variable blocksizes.<br>
So it's better to assume that blocksize is not constant.</blockquote><div><br></div><div><span style="font-size:13px">The STREAMINFO lists a minimum and maximum blocksize used in the stream, those bounds can be checked for.</span></div></div></div></div>