wmalosslessdec: make MCLMS arrays big enough for what is written into them.
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 14 Apr 2012 12:49:22 +0000 (14:49 +0200)
committerAnton Khirnov <anton@khirnov.net>
Sat, 29 Sep 2012 17:14:25 +0000 (19:14 +0200)
Fixes a part of CVE-2012-2795

CC:libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
libavcodec/wmalosslessdec.c

index c67a392..cfa877f 100644 (file)
@@ -129,8 +129,8 @@ typedef struct WmallDecodeCtx {
     int8_t  mclms_scaling;
     int16_t mclms_coeffs[128];
     int16_t mclms_coeffs_cur[4];
-    int16_t mclms_prevvalues[64];
-    int16_t mclms_updates[64];
+    int16_t mclms_prevvalues[WMALL_MAX_CHANNELS * 2 * 32];
+    int16_t mclms_updates[WMALL_MAX_CHANNELS * 2 * 32];
     int     mclms_recent;
 
     int     movave_scaling;