Module: libav Branch: release/0.8 Commit: d7de11260bd1f656b475dbe96c10a602fbff332e
Author: Justin Ruggles <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Sat Sep 29 11:31:35 2012 -0400 ac3dec: ensure get_buffer() gets a buffer for the correct number of channels If there is an error during frame parsing, but AVCodecContext.channels was changed and AC3DecodeContext.out_channels was set previously, the two may not match. Fixes CVE-2012-2802 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: [email protected] (cherry picked from commit 56b6a43056235fc110a018678da590595734203d) Signed-off-by: Reinhard Tartler <[email protected]> --- libavcodec/ac3dec.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index fdc1d68..28a783a 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -1404,6 +1404,7 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data, avctx->audio_service_type = AV_AUDIO_SERVICE_TYPE_KARAOKE; /* get output buffer */ + avctx->channels = s->out_channels; s->frame.nb_samples = s->num_blocks * 256; if ((ret = avctx->get_buffer(avctx, &s->frame)) < 0) { av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
