generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

dpcm: ignore extra unpaired bytes in stereo streams.

Browse Source 
Fixes: CVE-2011-3951

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ce7aee9b73)
(cherry picked from commit eaeaeb265f)

Conflicts:

	libavcodec/dpcm.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Alex Converse
2012-02-17 14:13:40 -08:00
committed by Reinhard Tartler
parent 2f2fd8c6d1
commit 654b24f68a
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/dpcm.c
View File

@@ -169,6 +169,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx,
int in, out = 0; int in, out = 0;
int predictor[2]; int predictor[2];
int channel_number = 0; int channel_number = 0;
int stereo = s->channels - 1;
short *output_samples = data; short *output_samples = data;
int shift[2]; int shift[2];
unsigned char byte; unsigned char byte;
@@ -177,6 +178,9 @@ static int dpcm_decode_frame(AVCodecContext *avctx,
if (!buf_size) if (!buf_size)
return 0; return 0;
if (stereo && (buf_size & 1))
buf_size--;
// almost every DPCM variant expands one byte of data into two // almost every DPCM variant expands one byte of data into two
if(*data_size/2 < buf_size) if(*data_size/2 < buf_size)
return -1; return -1;
@@ -295,7 +299,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx,
} }
*data_size = out * sizeof(short); *data_size = out * sizeof(short);
return buf_size; return avpkt->size;
} }
#define DPCM_DECODER(id, name, long_name_) \ #define DPCM_DECODER(id, name, long_name_) \