diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-10-01 00:45:02 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-10-01 02:41:40 +0200 |
| commit | 346876ec168affe7c21be88d8f1acf1a75cc8409 (patch) | |
| tree | 66133b4cb7b0b669605c7cf98ec55c8f853aa756 /libavcodec/adpcm.c | |
| parent | a5d46235f3f70f0b620f8e54649ece45ecc5b170 (diff) | |
Fix out of bound reads due to integer overflow in the ADPCM IMA Electronic Arts EACS decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/adpcm.c')
| -rw-r--r-- | libavcodec/adpcm.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index 3cb62e31ed..cf609e74f1 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -641,10 +641,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx, buf_size -= 128; } break; - case CODEC_ID_ADPCM_IMA_EA_EACS: + case CODEC_ID_ADPCM_IMA_EA_EACS: { + unsigned header_size = 4 + (8<<st); samples_in_chunk = bytestream_get_le32(&src) >> (1-st); - if (samples_in_chunk > buf_size-4-(8<<st)) { + if (buf_size < header_size || samples_in_chunk > buf_size - header_size) { src += buf_size - 4; break; } @@ -659,6 +660,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, *samples++ = adpcm_ima_expand_nibble(&c->status[st], *src&0x0F, 3); } break; + } case CODEC_ID_ADPCM_IMA_EA_SEAD: for (; src < buf+buf_size; src++) { *samples++ = adpcm_ima_expand_nibble(&c->status[0], src[0] >> 4, 6); |