[FFmpeg-devel] [PATCH] avcodec/alsdec: use correct variable when checking for overwrite

[Michael Niedermayer]

On Fri, Jun 30, 2017 at 07:34:32PM +0200, Paul B Mahol wrote:
> On 6/30/17, Thilo Borgmann <thilo.borgmann at mail.de> wrote:
> > Am 30.06.17 um 18:43 schrieb Paul B Mahol:
> >> Fixes #5297.
> >>
> >> Signed-off-by: Paul B Mahol <onemda at gmail.com>
> >> ---
> >>  libavcodec/alsdec.c | 4 ++--
> >>  1 file changed, 2 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
> >> index d95e30d..a925502 100644
> >> --- a/libavcodec/alsdec.c
> >> +++ b/libavcodec/alsdec.c
> >> @@ -705,8 +705,8 @@ static int read_var_block_data(ALSDecContext *ctx,
> >> ALSBlockData *bd)
> >>          } else {
> >>              *bd->opt_order = sconf->max_order;
> >>          }
> >> -        if (*bd->opt_order > bd->block_length) {
> >> -            *bd->opt_order = bd->block_length;
> >> +        if (*bd->opt_order > sconf->max_order) {
> >> +            *bd->opt_order = sconf->max_order;
> >>              av_log(avctx, AV_LOG_ERROR, "Predictor order too large.\n");
> >>              return AVERROR_INVALIDDATA;
> >>          }
> >
> >
> > This check will never fire because in all cases this check has already been
> > applied or opt_order is explicitly set to equal max_order. See code above.
> >
> > Paul, seriously, are you just trying to get me even more busy?
> 
> Does it fixes crash or not?

i can confirm that this does not fix it.
It crashes with the patch


[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Good people do not need laws to tell them to act responsibly, while bad
people will find a way around the laws. -- Plato
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20170701/c81797ce/attachment.sig>