Module: libav Branch: release/0.8 Commit: eaeaeb265fe46e1d81452960de918227541873b4
Author: Alex Converse <[email protected]> Committer: Alex Converse <[email protected]> Date: Fri Feb 17 14:13:40 2012 -0800 dpcm: ignore extra unpaired bytes in stereo streams. Fixes: CVE-2011-3951 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind (cherry picked from commit ce7aee9b733134649a6ce2fa743e51733f33e67e) --- libavcodec/dpcm.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/libavcodec/dpcm.c b/libavcodec/dpcm.c index 1b0f6b0..7f5dbfe 100644 --- a/libavcodec/dpcm.c +++ b/libavcodec/dpcm.c @@ -183,6 +183,11 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void *data, int stereo = s->channels - 1; int16_t *output_samples; + if (stereo && (buf_size & 1)) { + buf_size--; + buf_end--; + } + /* calculate output size */ switch(avctx->codec->id) { case CODEC_ID_ROQ_DPCM: @@ -317,7 +322,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void *data, *got_frame_ptr = 1; *(AVFrame *)data = s->frame; - return buf_size; + return avpkt->size; } #define DPCM_DECODER(id_, name_, long_name_) \ _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
