diff options
| author | Alex Converse <[email protected]> | 2012-01-10 13:07:09 -0800 |
|---|---|---|
| committer | Reinhard Tartler <[email protected]> | 2012-05-28 21:21:53 +0200 |
| commit | 32b73701c72153980cbd09743bf3011a08e6af90 (patch) | |
| tree | a66bdd7927dbaa2e4358b79da2f6d4064f8a4f66 | |
| parent | 212217504afc45ac96d5a070e8bda3604bcda092 (diff) | |
aacsbr: prevent out of bounds memcpy().
Fixes Libav Bug 195.
Fixes CVE-2012-0850
This doesn't make the code handle sample rate or upsample/downsample
change properly but this is still a good sanity check.
Based on change by Michael Niedermayer.
Signed-off-by: Alex Converse <[email protected]>
(cherry picked from commit 17ce52912f59a74ecc265e062578fb1181456e18)
Signed-off-by: Reinhard Tartler <[email protected]>
(cherry picked from commit 01804cc91ab231ac79092eee21325d7644357975)
Conflicts:
libavcodec/aacsbr.c
Signed-off-by: Reinhard Tartler <[email protected]>
| -rw-r--r-- | libavcodec/aacsbr.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/libavcodec/aacsbr.c b/libavcodec/aacsbr.c index cac34bb085..a8ce7ce9a2 100644 --- a/libavcodec/aacsbr.c +++ b/libavcodec/aacsbr.c @@ -1182,14 +1182,15 @@ static void sbr_qmf_synthesis(DSPContext *dsp, FFTContext *mdct, int i, n; const float *sbr_qmf_window = div ? sbr_qmf_window_ds : sbr_qmf_window_us; int scale_and_bias = scale != 1.0f || bias != 0.0f; + const int step = 128 >> div; float *v; for (i = 0; i < 32; i++) { - if (*v_off == 0) { + if (*v_off < step) { int saved_samples = (1280 - 128) >> div; memcpy(&v0[SBR_SYNTHESIS_BUF_SIZE - saved_samples], v0, saved_samples * sizeof(float)); - *v_off = SBR_SYNTHESIS_BUF_SIZE - saved_samples - (128 >> div); + *v_off = SBR_SYNTHESIS_BUF_SIZE - saved_samples - step; } else { - *v_off -= 128 >> div; + *v_off -= step; } v = v0 + *v_off; if (div) { |