Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/audiofile/patches/audiofile-0.3.6-clamp-index-values-to-fix-index-overflow-in-IMA.cpp.patch

    Contents of /trunk/audiofile/patches/audiofile-0.3.6-clamp-index-values-to-fix-index-overflow-in-IMA.cpp.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3077 - (show annotations) (download)
    Mon Jan 22 12:38:50 2018 UTC (6 years, 3 months ago) by niro
    File size: 1226 byte(s) 
    -added several security and build fixes
    1 From: Antonio Larrosa <larrosa@kde.org>
    2 Date: Mon, 6 Mar 2017 18:02:31 +0100
    3 Subject: clamp index values to fix index overflow in IMA.cpp
    4
    5 This fixes #33
    6 (also reported at https://bugzilla.opensuse.org/show_bug.cgi?id=1026981
    7 and https://blogs.gentoo.org/ago/2017/02/20/audiofile-global-buffer-overflow-in-decodesample-ima-cpp/)
    8 ---
    9 libaudiofile/modules/IMA.cpp | 4 ++--
    10 1 file changed, 2 insertions(+), 2 deletions(-)
    11
    12 diff --git a/libaudiofile/modules/IMA.cpp b/libaudiofile/modules/IMA.cpp
    13 index 7476d44..df4aad6 100644
    14 --- a/libaudiofile/modules/IMA.cpp
    15 +++ b/libaudiofile/modules/IMA.cpp
    16 @@ -169,7 +169,7 @@ int IMA::decodeBlockWAVE(const uint8_t *encoded, int16_t *decoded)
    17 if (encoded[1] & 0x80)
    18 m_adpcmState[c].previousValue -= 0x10000;
    19
    20 - m_adpcmState[c].index = encoded[2];
    21 + m_adpcmState[c].index = clamp(encoded[2], 0, 88);
    22
    23 *decoded++ = m_adpcmState[c].previousValue;
    24
    25 @@ -210,7 +210,7 @@ int IMA::decodeBlockQT(const uint8_t *encoded, int16_t *decoded)
    26 predictor -= 0x10000;
    27
    28 state.previousValue = clamp(predictor, MIN_INT16, MAX_INT16);
    29 - state.index = encoded[1] & 0x7f;
    30 + state.index = clamp(encoded[1] & 0x7f, 0, 88);
    31 encoded += 2;
    32
    33 for (int n=0; n<m_framesPerPacket; n+=2)