mp3dec: Fix possibly exploitable crash
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 27 Sep 2012 23:38:44 +0000 (01:38 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 27 Sep 2012 23:45:53 +0000 (01:45 +0200)
I was sadly unable to find a non fuzzed mp3 that uses the
feature that contained the bug (and i searched hard ...), thus
while this fixes the security issue. It may or may not fix
mixed blocks in 8khz mp3s, i cant say due to lack of samples to test.

Security issue exists since: b37d945dd4213cb8e92146571b0374cd45d52286

Reported-by: Dale Curtis <dalecurtis@google.com>
(Probably) Found-by: inferno@chromium.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/mpegaudiodec.c

index 2393da7..d6de1f7 100644 (file)
@@ -213,7 +213,7 @@ static void ff_compute_band_indexes(MPADecodeContext *s, GranuleDef *g)
             else
                 g->long_end = 6;
 
-            g->short_start = 2 + (s->sample_rate_index != 8);
+            g->short_start = 3;
         } else {
             g->long_end    = 0;
             g->short_start = 0;