diff options
| author | Google Chrome <> | 2010-02-09 19:59:11 +0000 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2010-02-09 19:59:11 +0000 |
| commit | 9e3935dfd8c68608534206859b16239a652db37f (patch) | |
| tree | 80195592d24f9f01397953822bbe143f39503309 | |
| parent | 4f5ee3f87b143587309471e1c0fa804847939f65 (diff) | |
| download | ffmpeg-9e3935dfd8c68608534206859b16239a652db37f.tar.gz | |
Check submap indexes.
10_vorbis_submap_indexes.patch by chrome.
I am applying this even though Reimar had some comments to improve it as it fixes
a serious security issue and I do not want to leave such things unfixed.
backport r20001 by michael
Originally committed as revision 21730 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
| -rw-r--r-- | libavcodec/vorbis_dec.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/libavcodec/vorbis_dec.c b/libavcodec/vorbis_dec.c index b70d5a51c4..6cfdf48ee7 100644 --- a/libavcodec/vorbis_dec.c +++ b/libavcodec/vorbis_dec.c @@ -757,9 +757,20 @@ static int vorbis_parse_setup_hdr_mappings(vorbis_context *vc) { } for(j=0;j<mapping_setup->submaps;++j) { + int bits; skip_bits(gb, 8); // FIXME check? - mapping_setup->submap_floor[j]=get_bits(gb, 8); - mapping_setup->submap_residue[j]=get_bits(gb, 8); + bits=get_bits(gb, 8); + if (bits>=vc->floor_count) { + av_log(vc->avccontext, AV_LOG_ERROR, "submap floor value %d out of range. \n", bits); + return -1; + } + mapping_setup->submap_floor[j]=bits; + bits=get_bits(gb, 8); + if (bits>=vc->residue_count) { + av_log(vc->avccontext, AV_LOG_ERROR, "submap residue value %d out of range. \n", bits); + return -1; + } + mapping_setup->submap_residue[j]=bits; AV_DEBUG(" %d mapping %d submap : floor %d, residue %d \n", i, j, mapping_setup->submap_floor[j], mapping_setup->submap_residue[j]); } |