[FFmpeg-devel] [PATCH] sonic: make sure num_taps is not larger than frame_size

[Michael Niedermayer]

On Wed, Dec 16, 2015 at 07:27:05PM +0100, Andreas Cadhalpun wrote:
> On 16.12.2015 02:08, Michael Niedermayer wrote:
> > On Tue, Dec 15, 2015 at 11:50:21PM +0100, Andreas Cadhalpun wrote:
> >> If that is the case, the loop setting predictor_state in
> >> sonic_decode_frame causes out of bounds reads of int_samples, which has
> >> only frame_size number of elements.
> >>
> >> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
> >> ---
> >>  libavcodec/sonic.c | 7 +++++++
> >>  1 file changed, 7 insertions(+)
> >>
> >> diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c
> >> index 4ec7d89..8522de3 100644
> >> --- a/libavcodec/sonic.c
> >> +++ b/libavcodec/sonic.c
> >> @@ -928,6 +928,13 @@ static av_cold int sonic_decode_init(AVCodecContext *avctx)
> >>      s->frame_size = s->channels*s->block_align*s->downsampling;
> >>  //    avctx->frame_size = s->block_align;
> >>  
> >> +    if (s->num_taps > s->frame_size) {
> > 
> > shouldt this be something like
> > num_taps* channels > frame_size ?
> 
> Of course. New patch attached.
> 
> Best regards,
> Andreas
> 

>  sonic.c |    7 +++++++
>  1 file changed, 7 insertions(+)
> cfe08ddd0c3dcae138abec66e1e08e628a88b41a  0001-sonic-make-sure-num_taps-channels-is-not-larger-than.patch
> From fc862d93329111339b020f4a92683ffd75005f9b Mon Sep 17 00:00:00 2001
> From: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
> Date: Tue, 15 Dec 2015 23:43:03 +0100
> Subject: [PATCH] sonic: make sure num_taps * channels is not larger than
>  frame_size
> 
> If that is the case, the loop setting predictor_state in
> sonic_decode_frame causes out of bounds reads of int_samples, which has
> only frame_size number of elements.

LGTM

thx


[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

I know you won't believe me, but the highest form of Human Excellence is
to question oneself and others. -- Socrates
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20151216/996497c4/attachment.sig>