Skip to content

F
ffmpeg.wasm-core
Commit c7f89064 authored by Laurent Aimar's avatar Laurent Aimar Committed by Janne Grunau
Browse files
Options

adpcm: fix out of bound reads due to integer overflow 

Signed-off-by: 's avatarJanne Grunau <janne-libav@jannau.net>
parent 2475f1a8
Hide whitespace changes
Inline Side-by-side
Showing with 4 additions and 2 deletions
libavcodec/adpcm.c
View file @ c7f89064
...@@ -630,10 +630,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx, ...@@ -630,10 +630,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx,
buf_size -= 128; buf_size -= 128;
} }
break; break;
case CODEC_ID_ADPCM_IMA_EA_EACS: case CODEC_ID_ADPCM_IMA_EA_EACS: {
unsigned header_size = 4 + (8<<st);
samples_in_chunk = bytestream_get_le32(&src) >> (1-st); samples_in_chunk = bytestream_get_le32(&src) >> (1-st);
if (samples_in_chunk > buf_size-4-(8<<st)) { if (buf_size < header_size || samples_in_chunk > buf_size - header_size) {
src += buf_size - 4; src += buf_size - 4;
break; break;
} }
...@@ -648,6 +649,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, ...@@ -648,6 +649,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx,
*samples++ = adpcm_ima_expand_nibble(&c->status[st], *src&0x0F, 3); *samples++ = adpcm_ima_expand_nibble(&c->status[st], *src&0x0F, 3);
} }
break; break;
}
case CODEC_ID_ADPCM_IMA_EA_SEAD: case CODEC_ID_ADPCM_IMA_EA_SEAD:
for (; src < buf+buf_size; src++) { for (; src < buf+buf_size; src++) {
*samples++ = adpcm_ima_expand_nibble(&c->status[0], src[0] >> 4, 6); *samples++ = adpcm_ima_expand_nibble(&c->status[0], src[0] >> 4, 6);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment