diff options
| author | Alex Converse <alex.converse@gmail.com> | 2012-02-17 14:13:40 -0800 |
|---|---|---|
| committer | Alex Converse <alex.converse@gmail.com> | 2012-03-06 15:28:01 -0800 |
| commit | eaeaeb265fe46e1d81452960de918227541873b4 (patch) | |
| tree | 521c6cfc78cb540a5458b023e8a072c87c66d69f | |
| parent | db315c796d7f07f0dcd7d3be1e9cb77ae6afee6e (diff) | |
| download | ffmpeg-eaeaeb265fe46e1d81452960de918227541873b4.tar.gz | |
dpcm: ignore extra unpaired bytes in stereo streams.
Fixes: CVE-2011-3951
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ce7aee9b733134649a6ce2fa743e51733f33e67e)
| -rw-r--r-- | libavcodec/dpcm.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavcodec/dpcm.c b/libavcodec/dpcm.c index 1b0f6b005b..7f5dbfe3b9 100644 --- a/libavcodec/dpcm.c +++ b/libavcodec/dpcm.c @@ -183,6 +183,11 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void *data, int stereo = s->channels - 1; int16_t *output_samples; + if (stereo && (buf_size & 1)) { + buf_size--; + buf_end--; + } + /* calculate output size */ switch(avctx->codec->id) { case CODEC_ID_ROQ_DPCM: @@ -317,7 +322,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void *data, *got_frame_ptr = 1; *(AVFrame *)data = s->frame; - return buf_size; + return avpkt->size; } #define DPCM_DECODER(id_, name_, long_name_) \ |