generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Check rangebits to avoid a possible crash.

Browse Source 
Fixes issue 2548 (and Chrome issue 68115 and unknown CERT issues).

Patch by Frank Barchard, fbarchard at google

Originally committed as revision 26365 to svn://svn.ffmpeg.org/ffmpeg/trunk
(cherry picked from commit 13184036a6b1b1d4b61c91118c0896e9ad4634c3)

Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net>
This commit is contained in:
Frank Barchard 2011-01-15 16:19:06 +00:00 committed by Janne Grunau
parent 4ac56bf7dc
commit 5e3d023702
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/vorbis_dec.c
View File

@ -477,6 +477,7 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
if (floor_setup->floor_type == 1) { if (floor_setup->floor_type == 1) {
uint_fast8_t maximum_class = 0; uint_fast8_t maximum_class = 0;
uint_fast8_t rangebits; uint_fast8_t rangebits;
uint_fast32_t rangemax;
uint_fast16_t floor1_values = 2; uint_fast16_t floor1_values = 2;
floor_setup->decode = vorbis_floor1_decode; floor_setup->decode = vorbis_floor1_decode;
@ -530,8 +531,15 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
rangebits = get_bits(gb, 4); rangebits = get_bits(gb, 4);
rangemax = (1 << rangebits);
if (rangemax > vc->blocksize[1] / 2) {
av_log(vc->avccontext, AV_LOG_ERROR,
"Floor value is too large for blocksize: %d (%d)\n",
rangemax, vc->blocksize[1] / 2);
return -1;
}
floor_setup->data.t1.list[0].x = 0; floor_setup->data.t1.list[0].x = 0;
floor_setup->data.t1.list[1].x = (1 << rangebits); floor_setup->data.t1.list[1].x = rangemax;
for (j = 0; j < floor_setup->data.t1.partitions; ++j) { for (j = 0; j < floor_setup->data.t1.partitions; ++j) {
for (k = 0; k < floor_setup->data.t1.class_dimensions[floor_setup->data.t1.partition_class[j]]; ++k, ++floor1_values) { for (k = 0; k < floor_setup->data.t1.class_dimensions[floor_setup->data.t1.partition_class[j]]; ++k, ++floor1_values) {