[FFmpeg-devel] [PATCH] sonic: make sure num_taps is not larger than frame_size

[Andreas Cadhalpun]

On 16.12.2015 02:08, Michael Niedermayer wrote:
> On Tue, Dec 15, 2015 at 11:50:21PM +0100, Andreas Cadhalpun wrote:
>> If that is the case, the loop setting predictor_state in
>> sonic_decode_frame causes out of bounds reads of int_samples, which has
>> only frame_size number of elements.
>>
>> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
>> ---
>>  libavcodec/sonic.c | 7 +++++++
>>  1 file changed, 7 insertions(+)
>>
>> diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c
>> index 4ec7d89..8522de3 100644
>> --- a/libavcodec/sonic.c
>> +++ b/libavcodec/sonic.c
>> @@ -928,6 +928,13 @@ static av_cold int sonic_decode_init(AVCodecContext *avctx)
>>      s->frame_size = s->channels*s->block_align*s->downsampling;
>>  //    avctx->frame_size = s->block_align;
>>  
>> +    if (s->num_taps > s->frame_size) {
> 
> shouldt this be something like
> num_taps* channels > frame_size ?

Of course. New patch attached.

Best regards,
Andreas

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-sonic-make-sure-num_taps-channels-is-not-larger-than.patch
Type: text/x-diff
Size: 1421 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20151216/e2779f7d/attachment.patch>