On Tue, Dec 15, 2015 at 11:50:21PM +0100, Andreas Cadhalpun wrote:
> If that is the case, the loop setting predictor_state in
> sonic_decode_frame causes out of bounds reads of int_samples, which has
> only frame_size number of elements.
>
> Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
> ---
> libavcodec/sonic.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c
> index 4ec7d89..8522de3 100644
> --- a/libavcodec/sonic.c
> +++ b/libavcodec/sonic.c
> @@ -928,6 +928,13 @@ static av_cold int sonic_decode_init(AVCodecContext
> *avctx)
> s->frame_size = s->channels*s->block_align*s->downsampling;
> // avctx->frame_size = s->block_align;
>
> + if (s->num_taps > s->frame_size) {shouldt this be something like num_taps* channels > frame_size ? [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Awnsering whenever a program halts or runs forever is On a turing machine, in general impossible (turings halting problem). On any real computer, always possible as a real computer has a finite number of states N, and will either halt in less than N cycles or never halt.
signature.asc
Description: Digital signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
