RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

sonic: make sure num_taps * channels is not larger than frame_size 

If that is the case, the loop setting predictor_state in
sonic_decode_frame causes out of bounds reads of int_samples, which has
only frame_size number of elements.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 9637c2531f)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2015-12-15 23:43:03 +01:00
parent ea4b99f82c
commit 34b9c7612d
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/sonic.c
View File

@ -925,6 +925,13 @@ static av_cold int sonic_decode_init(AVCodecContext *avctx)
s->frame_size = s->channels*s->block_align*s->downsampling;
// avctx->frame_size = s->block_align;
if (s->num_taps * s->channels > s->frame_size) {
av_log(avctx, AV_LOG_ERROR,
"number of taps times channels (%d * %d) larger than frame size %d\n",
s->num_taps, s->channels, s->frame_size);
return AVERROR_INVALIDDATA;
}
av_log(avctx, AV_LOG_INFO, "Sonic: ver: %d.%d ls: %d dr: %d taps: %d block: %d frame: %d downsamp: %d\n",
s->version, s->minor_version, s->lossless, s->decorrelation, s->num_taps, s->block_align, s->frame_size, s->downsampling);