RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

mp3dec: Fix a heap-buffer-overflow 

In some cases, what is left to read from ptr is smaller than EXTRABYTES.

Based on a patch by Thierry Foucu <tfoucu@gmail.com>.

Signed-off-by: Alex Converse <alex.converse@gmail.com>
This commit is contained in:
Alex Converse 2012-01-25 15:46:14 -08:00
parent a3a0691bde
commit f372ce119b
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/mpegaudiodec.c
View File

@ -1378,16 +1378,17 @@ static int mp_decode_layer3(MPADecodeContext *s)
if (!s->adu_mode) {
int skip;
const uint8_t *ptr = s->gb.buffer + (get_bits_count(&s->gb)>>3);
int extrasize = av_clip(get_bits_left(&s->gb) >> 3, 0, EXTRABYTES);
assert((get_bits_count(&s->gb) & 7) == 0);
/* now we get bits from the main_data_begin offset */
av_dlog(s->avctx, "seekback: %d\n", main_data_begin);
//av_log(NULL, AV_LOG_ERROR, "backstep:%d, lastbuf:%d\n", main_data_begin, s->last_buf_size);
memcpy(s->last_buf + s->last_buf_size, ptr, EXTRABYTES);
memcpy(s->last_buf + s->last_buf_size, ptr, extrasize);
s->in_gb = s->gb;
init_get_bits(&s->gb, s->last_buf, s->last_buf_size*8);
#if !UNCHECKED_BITSTREAM_READER
s->gb.size_in_bits_plus8 += EXTRABYTES * 8;
s->gb.size_in_bits_plus8 += extrasize * 8;
#endif
s->last_buf_size <<= 3;
for (gr = 0; gr < nb_granules && (s->last_buf_size >> 3) < main_data_begin; gr++) {