generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

wma: fix invalid buffer size assumptions causing random overreads.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Ronald S. Bultje 2012-03-01 16:19:51 -08:00
parent 9d25f1f619
commit 349b7977e4
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/wma.h
View File

@ -124,7 +124,7 @@ typedef struct WMACodecContext {
/* output buffer for one frame and the last for IMDCT windowing */ /* output buffer for one frame and the last for IMDCT windowing */
DECLARE_ALIGNED(32, float, frame_out)[MAX_CHANNELS][BLOCK_MAX_SIZE * 2]; DECLARE_ALIGNED(32, float, frame_out)[MAX_CHANNELS][BLOCK_MAX_SIZE * 2];
/* last frame info */ /* last frame info */
uint8_t last_superframe[MAX_CODED_SUPERFRAME_SIZE + 4]; /* padding added */ uint8_t last_superframe[MAX_CODED_SUPERFRAME_SIZE + FF_INPUT_BUFFER_PADDING_SIZE]; /* padding added */
int last_bitoffset; int last_bitoffset;
int last_superframe_len; int last_superframe_len;
float noise_table[NOISE_TAB_SIZE]; float noise_table[NOISE_TAB_SIZE];

13
libavcodec/wmadec.c
View File

@ -845,6 +845,12 @@ static int wma_decode_superframe(AVCodecContext *avctx, void *data,
if (s->use_bit_reservoir) { if (s->use_bit_reservoir) {
bit_offset = get_bits(&s->gb, s->byte_offset_bits + 3); bit_offset = get_bits(&s->gb, s->byte_offset_bits + 3);
if (bit_offset > get_bits_left(&s->gb)) {
av_log(avctx, AV_LOG_ERROR,
"Invalid last frame bit offset %d > buf size %d (%d)\n",
bit_offset, get_bits_left(&s->gb), buf_size);
goto fail;
}
if (s->last_superframe_len > 0) { if (s->last_superframe_len > 0) {
// printf("skip=%d\n", s->last_bitoffset); // printf("skip=%d\n", s->last_bitoffset);
@ -861,9 +867,10 @@ static int wma_decode_superframe(AVCodecContext *avctx, void *data,
if (len > 0) { if (len > 0) {
*q++ = (get_bits)(&s->gb, len) << (8 - len); *q++ = (get_bits)(&s->gb, len) << (8 - len);
} }
memset(q, 0, FF_INPUT_BUFFER_PADDING_SIZE);
/* XXX: bit_offset bits into last frame */ /* XXX: bit_offset bits into last frame */
init_get_bits(&s->gb, s->last_superframe, MAX_CODED_SUPERFRAME_SIZE*8); init_get_bits(&s->gb, s->last_superframe, s->last_superframe_len * 8 + bit_offset);
/* skip unused bits */ /* skip unused bits */
if (s->last_bitoffset > 0) if (s->last_bitoffset > 0)
skip_bits(&s->gb, s->last_bitoffset); skip_bits(&s->gb, s->last_bitoffset);
@ -877,9 +884,9 @@ static int wma_decode_superframe(AVCodecContext *avctx, void *data,
/* read each frame starting from bit_offset */ /* read each frame starting from bit_offset */
pos = bit_offset + 4 + 4 + s->byte_offset_bits + 3; pos = bit_offset + 4 + 4 + s->byte_offset_bits + 3;
if (pos >= MAX_CODED_SUPERFRAME_SIZE * 8) if (pos >= MAX_CODED_SUPERFRAME_SIZE * 8 || pos > buf_size * 8)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
init_get_bits(&s->gb, buf + (pos >> 3), (MAX_CODED_SUPERFRAME_SIZE - (pos >> 3))*8); init_get_bits(&s->gb, buf + (pos >> 3), (buf_size - (pos >> 3))*8);
len = pos & 7; len = pos & 7;
if (len > 0) if (len > 0)
skip_bits(&s->gb, len); skip_bits(&s->gb, len);