On 16.12.2015 02:08, Michael Niedermayer wrote:
> On Tue, Dec 15, 2015 at 11:50:21PM +0100, Andreas Cadhalpun wrote:
>> If that is the case, the loop setting predictor_state in
>> sonic_decode_frame causes out of bounds reads of int_samples, which has
>> only frame_size number of elements.
>>
>> Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
>> ---
>> libavcodec/sonic.c | 7 +++++++
>> 1 file changed, 7 insertions(+)
>>
>> diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c
>> index 4ec7d89..8522de3 100644
>> --- a/libavcodec/sonic.c
>> +++ b/libavcodec/sonic.c
>> @@ -928,6 +928,13 @@ static av_cold int sonic_decode_init(AVCodecContext
>> *avctx)
>> s->frame_size = s->channels*s->block_align*s->downsampling;
>> // avctx->frame_size = s->block_align;
>>
>> + if (s->num_taps > s->frame_size) {
>
> shouldt this be something like
> num_taps* channels > frame_size ?
Of course. New patch attached.
Best regards,
Andreas
>From fc862d93329111339b020f4a92683ffd75005f9b Mon Sep 17 00:00:00 2001
From: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
Date: Tue, 15 Dec 2015 23:43:03 +0100
Subject: [PATCH] sonic: make sure num_taps * channels is not larger than
frame_size
If that is the case, the loop setting predictor_state in
sonic_decode_frame causes out of bounds reads of int_samples, which has
only frame_size number of elements.
Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
---
libavcodec/sonic.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c
index 4ec7d89..2e3ca79 100644
--- a/libavcodec/sonic.c
+++ b/libavcodec/sonic.c
@@ -928,6 +928,13 @@ static av_cold int sonic_decode_init(AVCodecContext *avctx)
s->frame_size = s->channels*s->block_align*s->downsampling;
// avctx->frame_size = s->block_align;
+ if (s->num_taps * s->channels > s->frame_size) {
+ av_log(avctx, AV_LOG_ERROR,
+ "number of taps times channels (%d * %d) larger than frame size %d\n",
+ s->num_taps, s->channels, s->frame_size);
+ return AVERROR_INVALIDDATA;
+ }
+
av_log(avctx, AV_LOG_INFO, "Sonic: ver: %d.%d ls: %d dr: %d taps: %d block: %d frame: %d downsamp: %d\n",
s->version, s->minor_version, s->lossless, s->decorrelation, s->num_taps, s->block_align, s->frame_size, s->downsampling);
--
2.6.2
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
