[FFmpeg-devel] [PATCH] sonic: make sure num_taps is not larger than frame_size

[Michael Niedermayer]

On Tue, Dec 15, 2015 at 11:50:21PM +0100, Andreas Cadhalpun wrote:
> If that is the case, the loop setting predictor_state in
> sonic_decode_frame causes out of bounds reads of int_samples, which has
> only frame_size number of elements.
> 
> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
> ---
>  libavcodec/sonic.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c
> index 4ec7d89..8522de3 100644
> --- a/libavcodec/sonic.c
> +++ b/libavcodec/sonic.c
> @@ -928,6 +928,13 @@ static av_cold int sonic_decode_init(AVCodecContext *avctx)
>      s->frame_size = s->channels*s->block_align*s->downsampling;
>  //    avctx->frame_size = s->block_align;
>  
> +    if (s->num_taps > s->frame_size) {

shouldt this be something like
num_taps* channels > frame_size ?

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Awnsering whenever a program halts or runs forever is
On a turing machine, in general impossible (turings halting problem).
On any real computer, always possible as a real computer has a finite number
of states N, and will either halt in less than N cycles or never halt.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20151216/964256b7/attachment.sig>