Commit 065b3a1c authored by Anton Khirnov's avatar Anton Khirnov

wmalosslessdec: increase channel_coeffs/residues size

Fixes CVE-2012-2792

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
parent 4a969030
......@@ -23,6 +23,8 @@
*/
#include "libavutil/attributes.h"
#include "libavutil/avassert.h"
#include "avcodec.h"
#include "internal.h"
#include "get_bits.h"
......@@ -158,14 +160,14 @@ typedef struct WmallDecodeCtx {
int ave_sum[2];
int channel_residues[2][2048];
int channel_residues[2][WMALL_BLOCK_MAX_SIZE];
int lpc_coefs[2][40];
int lpc_order;
int lpc_scaling;
int lpc_intbits;
int channel_coeffs[2][2048];
int channel_coeffs[2][WMALL_BLOCK_MAX_SIZE];
} WmallDecodeCtx;
......@@ -215,6 +217,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
/* get frame len */
s->samples_per_frame = 1 << ff_wma_get_frame_len_bits(avctx->sample_rate,
3, s->decode_flags);
av_assert0(s->samples_per_frame <= WMALL_BLOCK_MAX_SIZE);
/* init previous block len */
for (i = 0; i < avctx->channels; i++)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment