Fix out of bound reads due to integer overflow in the ADPCM IMA Electronic Arts EACS...
authorLaurent Aimar <fenrir@videolan.org>
Fri, 30 Sep 2011 22:45:02 +0000 (00:45 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 1 Oct 2011 00:41:40 +0000 (02:41 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/adpcm.c

index 3cb62e3..cf609e7 100644 (file)
@@ -641,10 +641,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx,
             buf_size -= 128;
         }
         break;
-    case CODEC_ID_ADPCM_IMA_EA_EACS:
+    case CODEC_ID_ADPCM_IMA_EA_EACS: {
+        unsigned header_size = 4 + (8<<st);
         samples_in_chunk = bytestream_get_le32(&src) >> (1-st);
 
-        if (samples_in_chunk > buf_size-4-(8<<st)) {
+        if (buf_size < header_size || samples_in_chunk > buf_size - header_size) {
             src += buf_size - 4;
             break;
         }
@@ -659,6 +660,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx,
             *samples++ = adpcm_ima_expand_nibble(&c->status[st], *src&0x0F, 3);
         }
         break;
+    }
     case CODEC_ID_ADPCM_IMA_EA_SEAD:
         for (; src < buf+buf_size; src++) {
             *samples++ = adpcm_ima_expand_nibble(&c->status[0], src[0] >> 4, 6);