1. ffmpeg
  2. Commit cfda2a677c25f407fe4a93213e977e4a0106b3ac
Browse code

avcodec/wmaprodec: Fix integer overflow in sfb_offsets initialization

Fixes out of array read
Fixes: asan_heap-oob_2aec5b0_1828_classical_22_16_2_16000_v3c_0_exclusive_0_29.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5dcb99033df16eccc4dbbc4a099ad64457f9f090)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2014/11/11 07:07:50
Showing 1 changed files
libavcodec/wmaprodec.c
History View file @ cfda2a6
... ... 
@@ -422,6 +422,9 @@ static av_cold int decode_init(AVCodecContext *avctx)
422 422 
             offset &= ~3;
423 423 
             if (offset > s->sfb_offsets[i][band - 1])
424 424 
                 s->sfb_offsets[i][band++] = offset;
425 
+
426 
+            if (offset >= subframe_len)
427 
+                break;
425 428 
         }
426 429 
         s->sfb_offsets[i][band - 1] = subframe_len;
427 430 
         s->num_sfb[i]               = band - 1;