Mercurial > libavcodec.hg
changeset 5674:ca944f1db2b3 libavcodec
Add checks on input/output buffers size for some audio decoders
| author | kostya |
|---|---|
| date | Thu, 13 Sep 2007 05:59:58 +0000 |
| parents | 9810f0bbacb2 |
| children | d328f1731a6c |
| files | smacker.c truespeech.c ws-snd1.c |
| diffstat | 3 files changed, 17 insertions(+), 3 deletions(-) [+] |
line wrap: on
line diff
--- a/smacker.c Thu Sep 13 03:22:47 2007 +0000 +++ b/smacker.c Thu Sep 13 05:59:58 2007 +0000 @@ -590,6 +590,10 @@ } stereo = get_bits1(&gb); bits = get_bits1(&gb); + if ((unp_size << !bits) > *data_size) { + av_log(avctx, AV_LOG_ERROR, "Frame is too large to fit in buffer\n"); + return -1; + } memset(vlc, 0, sizeof(VLC) * 4); memset(h, 0, sizeof(HuffContext) * 4);
--- a/truespeech.c Thu Sep 13 03:22:47 2007 +0000 +++ b/truespeech.c Thu Sep 13 05:59:58 2007 +0000 @@ -333,15 +333,17 @@ { TSContext *c = avctx->priv_data; - int i; + int i, j; short *samples = data; int consumed = 0; int16_t out_buf[240]; + int iterations; if (!buf_size) return 0; - while (consumed < buf_size) { + iterations = FFMIN(buf_size / 32, *data_size / 480); + for(j = 0; j < iterations; j++) { truespeech_read_frame(c, buf + consumed); consumed += 32; @@ -366,7 +368,7 @@ *data_size = consumed * 15; - return buf_size; + return consumed; } AVCodec truespeech_decoder = {
--- a/ws-snd1.c Thu Sep 13 03:22:47 2007 +0000 +++ b/ws-snd1.c Thu Sep 13 05:59:58 2007 +0000 @@ -62,6 +62,14 @@ in_size = AV_RL16(&buf[2]); buf += 4; + if (out_size > *data_size) { + av_log(avctx, AV_LOG_ERROR, "Frame is too large to fit in buffer\n"); + return -1; + } + if (in_size > buf_size) { + av_log(avctx, AV_LOG_ERROR, "Frame data is larger than input buffer\n"); + return -1; + } if (in_size == out_size) { for (i = 0; i < out_size; i++) *samples++ = (*buf++ - 0x80) << 8;