diff options
| author | Michael Niedermayer <[email protected]> | 2014-02-07 15:07:23 +0100 |
|---|---|---|
| committer | Anton Khirnov <[email protected]> | 2014-08-05 14:59:29 +0000 |
| commit | 6be5a3c0451e8f199ef1da09961aa76c08c87afd (patch) | |
| tree | fe3d70af3baa0d1c82ac7a91ebc05664e7353524 | |
| parent | 07015d9f913d63bdc4495e75f4603c586553796e (diff) | |
wmalosslessdec: fix mclms_coeffs* array size
Fixes corruption of context
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:[email protected]
Bug-Id: CVE-2014-2098
Signed-off-by: Anton Khirnov <[email protected]>
(cherry picked from commit 849b9d34c7ef70b370c53e7af3940f51cbc07d0f)
Signed-off-by: Anton Khirnov <[email protected]>
| -rw-r--r-- | libavcodec/wmalosslessdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c index 2f341c01c4..b12eabb89a 100644 --- a/libavcodec/wmalosslessdec.c +++ b/libavcodec/wmalosslessdec.c @@ -127,8 +127,8 @@ typedef struct WmallDecodeCtx { int8_t mclms_order; int8_t mclms_scaling; - int16_t mclms_coeffs[128]; - int16_t mclms_coeffs_cur[4]; + int16_t mclms_coeffs[WMALL_MAX_CHANNELS * WMALL_MAX_CHANNELS * 32]; + int16_t mclms_coeffs_cur[WMALL_MAX_CHANNELS * WMALL_MAX_CHANNELS]; int16_t mclms_prevvalues[WMALL_MAX_CHANNELS * 2 * 32]; int16_t mclms_updates[WMALL_MAX_CHANNELS * 2 * 32]; int mclms_recent; |