Module: libav Branch: master Commit: 607f57152c59bcec26caaf2060a86d96f76c4e8b
Author: Michael Niedermayer <[email protected]> Committer: Anton Khirnov <[email protected]> Date: Sat Apr 14 14:49:22 2012 +0200 wmalosslessdec: make MCLMS arrays big enough for what is written into them. Fixes a part of CVE-2012-2795 CC:[email protected] Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Anton Khirnov <[email protected]> --- libavcodec/wmalosslessdec.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c index c67a392..cfa877f 100644 --- a/libavcodec/wmalosslessdec.c +++ b/libavcodec/wmalosslessdec.c @@ -129,8 +129,8 @@ typedef struct WmallDecodeCtx { int8_t mclms_scaling; int16_t mclms_coeffs[128]; int16_t mclms_coeffs_cur[4]; - int16_t mclms_prevvalues[64]; - int16_t mclms_updates[64]; + int16_t mclms_prevvalues[WMALL_MAX_CHANNELS * 2 * 32]; + int16_t mclms_updates[WMALL_MAX_CHANNELS * 2 * 32]; int mclms_recent; int movave_scaling; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
