diff options
| author | Google Chrome <> | 2010-02-09 19:49:28 +0000 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2010-02-09 19:49:28 +0000 |
| commit | eb70d77e1ebe3104b83506dcb5708b581bb09a00 (patch) | |
| tree | e19a59730195d6c0552f48d9314fc9b609773069 | |
| parent | b8ec4c49bd751f23aa175dbb64ff8d75edb7b917 (diff) | |
Add checks for per-packet mode indexes and per-header mode mapping indexes.
12_vorbis_mode_indexes.patch by chrome
maybe exploitable
r19990 by michael
Originally committed as revision 21726 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
| -rw-r--r-- | libavcodec/vorbis_dec.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/libavcodec/vorbis_dec.c b/libavcodec/vorbis_dec.c index 4410fc04c3..bd8002eaf6 100644 --- a/libavcodec/vorbis_dec.c +++ b/libavcodec/vorbis_dec.c @@ -798,7 +798,11 @@ static int vorbis_parse_setup_hdr_modes(vorbis_context *vc) { mode_setup->blockflag=get_bits1(gb); mode_setup->windowtype=get_bits(gb, 16); //FIXME check mode_setup->transformtype=get_bits(gb, 16); //FIXME check - mode_setup->mapping=get_bits(gb, 8); //FIXME check + mode_setup->mapping=get_bits(gb, 8); + if (mode_setup->mapping>=vc->mapping_count) { + av_log(vc->avccontext, AV_LOG_ERROR, "mode mapping value %d out of range. \n", mode_setup->mapping); + return 1; + } AV_DEBUG(" %d mode: blockflag %d, windowtype %d, transformtype %d, mapping %d \n", i, mode_setup->blockflag, mode_setup->windowtype, mode_setup->transformtype, mode_setup->mapping); } @@ -1458,6 +1462,10 @@ static int vorbis_parse_audio_packet(vorbis_context *vc) { } else { mode_number=get_bits(gb, ilog(vc->mode_count-1)); } + if (mode_number>=vc->mode_count) { + av_log(vc->avccontext, AV_LOG_ERROR, "mode number %d out of range.\n", mode_number); + return -1; + } vc->mode_number=mode_number; mapping=&vc->mappings[vc->modes[mode_number].mapping]; |