[FFmpeg-devel] [PATCH 2/5] avcodec/wavpack: Fix overflow in k=31

[Michael Niedermayer]

On Fri, Dec 02, 2022 at 05:14:58PM +0100, Paul B Mahol wrote:
> On Thu, Dec 1, 2022 at 8:56 PM Michael Niedermayer <michael at niedermayer.cc>
> wrote:
> 
> > On Wed, Nov 30, 2022 at 09:39:44PM +0100, Paul B Mahol wrote:
> > > On 9/11/22, Michael Niedermayer <michael at niedermayer.cc> wrote:
> > > > Untested with "non fuzzed" samples as i have no such file
> > > >
> > >
> > > Then create it.
> >
> > the official WavPack-5.6.0 decoder has 2 alternative optimized codepathes
> > #ifdef USE_BITMASK_TABLES
> >     extras = bitset [bitcount] - maxcode - 1;
> > #else
> >     extras = (1 << bitcount) - maxcode - 1;
> > #endif
> >
> > The 2nd path would result in the same 1<<32 which is undefined but luckily
> > the first seems hardcoded to be used it uses this table:
> >
> > const uint32_t bitset [] = {
> >     1L << 0, 1L << 1, 1L << 2, 1L << 3,
> >     1L << 4, 1L << 5, 1L << 6, 1L << 7,
> >     1L << 8, 1L << 9, 1L << 10, 1L << 11,
> >     1L << 12, 1L << 13, 1L << 14, 1L << 15,
> >     1L << 16, 1L << 17, 1L << 18, 1L << 19,
> >     1L << 20, 1L << 21, 1L << 22, 1L << 23,
> >     1L << 24, 1L << 25, 1L << 26, 1L << 27,
> >     1L << 28, 1L << 29, 1L << 30, 1L << 31
> > };
> >
> > here bitset[32] is out of array
> >
> > Given above i suspect no valid file should use this. Otherwise something
> > seriously odd is going on.
> >
> > also the subject has a typo its p=31 not k=31
> >
> > thx
> >
> 
> OK

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The worst form of inequality is to try to make unequal things equal.
-- Aristotle
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20221203/f792d3d2/attachment.sig>