generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

dpcm: ignore extra unpaired bytes in stereo streams.

Browse Source 
Fixes: CVE-2011-3951

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ce7aee9b733134649a6ce2fa743e51733f33e67e)
(cherry picked from commit eaeaeb265fe46e1d81452960de918227541873b4)

Conflicts:

	libavcodec/dpcm.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 1ce9c93198fc997e8f23934a78e2937af670e4e9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Alex Converse 2012-02-17 14:13:40 -08:00 committed by Reinhard Tartler
parent e02249b130
commit 212217504a
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/dpcm.c
View File

@ -169,6 +169,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx,
int in, out = 0;
int predictor[2];
int channel_number = 0;
int stereo = s->channels - 1;
short *output_samples = data;
int shift[2];
unsigned char byte;
@ -177,6 +178,9 @@ static int dpcm_decode_frame(AVCodecContext *avctx,
if (!buf_size)
return 0;
if (stereo && (buf_size & 1))
buf_size--;
// almost every DPCM variant expands one byte of data into two
if(*data_size/2 < buf_size)
return -1;
@ -295,7 +299,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx,
}
*data_size = out * sizeof(short);
return buf_size;
return avpkt->size;
}
#define DPCM_DECODER(id, name, long_name_) \