Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/audiofile/patches/audiofile-0.3.6-clamp-index-values-to-fix-index-overflow-in-IMA.cpp.patch

    Annotation of /trunk/audiofile/patches/audiofile-0.3.6-clamp-index-values-to-fix-index-overflow-in-IMA.cpp.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3077 - (hide annotations) (download)
    Mon Jan 22 12:38:50 2018 UTC (6 years, 3 months ago) by niro
    File size: 1226 byte(s) 
    -added several security and build fixes
    1 niro 3077 From: Antonio Larrosa <larrosa@kde.org>
    2     Date: Mon, 6 Mar 2017 18:02:31 +0100
    3     Subject: clamp index values to fix index overflow in IMA.cpp
    4    
    5     This fixes #33
    6     (also reported at https://bugzilla.opensuse.org/show_bug.cgi?id=1026981
    7     and https://blogs.gentoo.org/ago/2017/02/20/audiofile-global-buffer-overflow-in-decodesample-ima-cpp/)
    8     ---
    9     libaudiofile/modules/IMA.cpp | 4 ++--
    10     1 file changed, 2 insertions(+), 2 deletions(-)
    11    
    12     diff --git a/libaudiofile/modules/IMA.cpp b/libaudiofile/modules/IMA.cpp
    13     index 7476d44..df4aad6 100644
    14     --- a/libaudiofile/modules/IMA.cpp
    15     +++ b/libaudiofile/modules/IMA.cpp
    16     @@ -169,7 +169,7 @@ int IMA::decodeBlockWAVE(const uint8_t *encoded, int16_t *decoded)
    17     if (encoded[1] & 0x80)
    18     m_adpcmState[c].previousValue -= 0x10000;
    19    
    20     - m_adpcmState[c].index = encoded[2];
    21     + m_adpcmState[c].index = clamp(encoded[2], 0, 88);
    22    
    23     *decoded++ = m_adpcmState[c].previousValue;
    24    
    25     @@ -210,7 +210,7 @@ int IMA::decodeBlockQT(const uint8_t *encoded, int16_t *decoded)
    26     predictor -= 0x10000;
    27    
    28     state.previousValue = clamp(predictor, MIN_INT16, MAX_INT16);
    29     - state.index = encoded[1] & 0x7f;
    30     + state.index = clamp(encoded[1] & 0x7f, 0, 88);
    31     encoded += 2;
    32    
    33     for (int n=0; n<m_framesPerPacket; n+=2)