har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vorbis: Avoid some out-of-bounds reads

Browse Source 
Fixes Bug: #190
Chromium Bug: #100543
Related to CVE-2011-3893

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 57cd6d709565e84e84385f8f2a9641ca3fa718be)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 4a94678f1be4b7d47f862e9523ca3358255da5d4)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 6d6254ba9fbb22260939c06db1faed5bbd295ad4)

Conflicts:

	libavcodec/vorbis.c
This commit is contained in:
Chris Evans 2012-01-05 21:25:41 +01:00 committed by Reinhard Tartler
parent 3eb6983dbc
commit 665421f3b1
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/vorbis.c
View File

@ -146,13 +146,13 @@ void ff_vorbis_ready_floor1_list(vorbis_floor1_entry * list, int values) {
} }
} }
static void render_line(int x0, int y0, int x1, int y1, float * buf) { static void render_line(int x0, uint8_t y0, int x1, int y1, float * buf) {
int dy = y1 - y0; int dy = y1 - y0;
int adx = x1 - x0; int adx = x1 - x0;
int base = dy / adx; int base = dy / adx;
int ady = FFABS(dy) - FFABS(base) * adx; int ady = FFABS(dy) - FFABS(base) * adx;
int x = x0; int x = x0;
int y = y0; uint8_t y = y0;
int err = 0; int err = 0;
int sy = dy<0 ? -1 : 1; int sy = dy<0 ? -1 : 1;
buf[x] = ff_vorbis_floor1_inverse_db_table[y]; buf[x] = ff_vorbis_floor1_inverse_db_table[y];
@ -168,7 +168,8 @@ static void render_line(int x0, int y0, int x1, int y1, float * buf) {
} }
void ff_vorbis_floor1_render_list(vorbis_floor1_entry * list, int values, uint_fast16_t * y_list, int * flag, int multiplier, float * out, int samples) { void ff_vorbis_floor1_render_list(vorbis_floor1_entry * list, int values, uint_fast16_t * y_list, int * flag, int multiplier, float * out, int samples) {
int lx, ly, i; int lx, i;
uint8_t ly;
lx = 0; lx = 0;
ly = y_list[0] * multiplier; ly = y_list[0] * multiplier;
for (i = 1; i < values; i++) { for (i = 1; i < values; i++) {