You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
198 lines
5.0 KiB
198 lines
5.0 KiB
; You can calculate where the next frame will start depending on things
|
|
; like the bitrate. See mad_header_decode(). It seems that when decoding
|
|
; the frame you can go past that boundary. This attempts to catch those cases,
|
|
; but might not catch all of them.
|
|
; For more info see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508133
|
|
Index: libmad-0.15.1b/layer12.c
|
|
===================================================================
|
|
--- a/layer12.c 2008-12-23 21:38:07.000000000 +0100
|
|
+++ b/layer12.c 2008-12-23 21:38:12.000000000 +0100
|
|
@@ -134,6 +134,12 @@
|
|
for (sb = 0; sb < bound; ++sb) {
|
|
for (ch = 0; ch < nch; ++ch) {
|
|
nb = mad_bit_read(&stream->ptr, 4);
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
|
|
if (nb == 15) {
|
|
stream->error = MAD_ERROR_BADBITALLOC;
|
|
@@ -146,6 +152,12 @@
|
|
|
|
for (sb = bound; sb < 32; ++sb) {
|
|
nb = mad_bit_read(&stream->ptr, 4);
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
|
|
if (nb == 15) {
|
|
stream->error = MAD_ERROR_BADBITALLOC;
|
|
@@ -162,6 +174,12 @@
|
|
for (ch = 0; ch < nch; ++ch) {
|
|
if (allocation[ch][sb]) {
|
|
scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
|
|
# if defined(OPT_STRICT)
|
|
/*
|
|
@@ -187,6 +205,12 @@
|
|
frame->sbsample[ch][s][sb] = nb ?
|
|
mad_f_mul(I_sample(&stream->ptr, nb),
|
|
sf_table[scalefactor[ch][sb]]) : 0;
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
}
|
|
}
|
|
|
|
@@ -195,6 +219,12 @@
|
|
mad_fixed_t sample;
|
|
|
|
sample = I_sample(&stream->ptr, nb);
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
|
|
for (ch = 0; ch < nch; ++ch) {
|
|
frame->sbsample[ch][s][sb] =
|
|
@@ -403,7 +433,15 @@
|
|
nbal = bitalloc_table[offsets[sb]].nbal;
|
|
|
|
for (ch = 0; ch < nch; ++ch)
|
|
+ {
|
|
allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
+ }
|
|
}
|
|
|
|
for (sb = bound; sb < sblimit; ++sb) {
|
|
@@ -411,6 +449,13 @@
|
|
|
|
allocation[0][sb] =
|
|
allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
|
|
+
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
}
|
|
|
|
/* decode scalefactor selection info */
|
|
@@ -419,6 +464,12 @@
|
|
for (ch = 0; ch < nch; ++ch) {
|
|
if (allocation[ch][sb])
|
|
scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
}
|
|
}
|
|
|
|
@@ -442,6 +493,12 @@
|
|
for (ch = 0; ch < nch; ++ch) {
|
|
if (allocation[ch][sb]) {
|
|
scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
|
|
switch (scfsi[ch][sb]) {
|
|
case 2:
|
|
@@ -452,11 +509,23 @@
|
|
|
|
case 0:
|
|
scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
/* fall through */
|
|
|
|
case 1:
|
|
case 3:
|
|
scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
}
|
|
|
|
if (scfsi[ch][sb] & 1)
|
|
@@ -488,6 +557,12 @@
|
|
index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
|
|
|
|
II_samples(&stream->ptr, &qc_table[index], samples);
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
|
|
for (s = 0; s < 3; ++s) {
|
|
frame->sbsample[ch][3 * gr + s][sb] =
|
|
@@ -506,6 +581,12 @@
|
|
index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
|
|
|
|
II_samples(&stream->ptr, &qc_table[index], samples);
|
|
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
|
|
for (ch = 0; ch < nch; ++ch) {
|
|
for (s = 0; s < 3; ++s) {
|
|
Index: libmad-0.15.1b/layer3.c
|
|
===================================================================
|
|
--- a/layer3.c 2008-12-23 21:38:07.000000000 +0100
|
|
+++ b/layer3.c 2008-12-23 21:38:12.000000000 +0100
|
|
@@ -2608,6 +2608,12 @@
|
|
next_md_begin = 0;
|
|
|
|
md_len = si.main_data_begin + frame_space - next_md_begin;
|
|
+ if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN)
|
|
+ {
|
|
+ stream->error = MAD_ERROR_LOSTSYNC;
|
|
+ stream->sync = 0;
|
|
+ return -1;
|
|
+ }
|
|
|
|
frame_used = 0;
|
|
|