diff options
| author | Alex Converse <alex.converse@gmail.com> | 2012-02-17 14:13:40 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-05-28 23:46:08 +0200 |
| commit | 7944a87ba8a6b1faf167d5b116dfa55233e0a697 (patch) | |
| tree | f9fea04b36227d9d492d18d78a50f59aeab91bfa /libavcodec | |
| parent | 4b2e02a4c4a618ac6d03fd38eb7ab0bc09596667 (diff) | |
| download | ffmpeg-7944a87ba8a6b1faf167d5b116dfa55233e0a697.tar.gz | |
dpcm: ignore extra unpaired bytes in stereo streams.
Fixes: CVE-2011-3951
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ce7aee9b733134649a6ce2fa743e51733f33e67e)
(cherry picked from commit eaeaeb265fe46e1d81452960de918227541873b4)
Conflicts:
libavcodec/dpcm.c
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 1ce9c93198fc997e8f23934a78e2937af670e4e9)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 41f1f146c9e29dde63e293078819474c9b8111a1)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/dpcm.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/dpcm.c b/libavcodec/dpcm.c index daa21cd09e..a364864ba3 100644 --- a/libavcodec/dpcm.c +++ b/libavcodec/dpcm.c @@ -167,6 +167,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx, int in, out = 0; int predictor[2]; int channel_number = 0; + int stereo = s->channels - 1; short *output_samples = data; int shift[2]; unsigned char byte; @@ -175,6 +176,9 @@ static int dpcm_decode_frame(AVCodecContext *avctx, if (!buf_size) return 0; + if (stereo && (buf_size & 1)) + buf_size--; + // almost every DPCM variant expands one byte of data into two if(*data_size/2 < buf_size) return -1; |