[libav-devel] [PATCH] apedec: Use bytestream2 functions to prevent buffer overreads.

[Aneesh Dogra]

---
 libavcodec/apedec.c |   30 +++++++++++++-----------------
 1 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c
index fa50d61..90f175b 100644
--- a/libavcodec/apedec.c
+++ b/libavcodec/apedec.c
@@ -154,8 +154,7 @@ typedef struct APEContext {
     APEFilter filters[APE_FILTER_LEVELS][2]; ///< filters used for 
reconstruction
 
     uint8_t *data;                           ///< current frame data
-    uint8_t *data_end;                       ///< frame data end
-    const uint8_t *ptr;                      ///< current position in frame 
data
+    GetByteContext g;                        ///< current position in frame 
data
 
     int error;
 } APEContext;
@@ -240,7 +239,7 @@ filter_alloc_fail:
 /** Start the decoder */
 static inline void range_start_decoding(APEContext *ctx)
 {
-    ctx->rc.buffer = bytestream_get_byte(&ctx->ptr);
+    ctx->rc.buffer = bytestream2_get_byte(&ctx->g);
     ctx->rc.low    = ctx->rc.buffer >> (8 - EXTRA_BITS);
     ctx->rc.range  = (uint32_t) 1 << EXTRA_BITS;
 }
@@ -250,9 +249,7 @@ static inline void range_dec_normalize(APEContext *ctx)
 {
     while (ctx->rc.range <= BOTTOM_VALUE) {
         ctx->rc.buffer <<= 8;
-        if(ctx->ptr < ctx->data_end) {
-            ctx->rc.buffer += *ctx->ptr;
-            ctx->ptr++;
+        ctx->rc.buffer += bytestream2_get_byte(&ctx->g);
         } else {
             ctx->error = 1;
         }
@@ -475,18 +472,18 @@ static void entropy_decode(APEContext *ctx, int 
blockstodecode, int stereo)
 static int init_entropy_decoder(APEContext *ctx)
 {
     /* Read the CRC */
-    if (ctx->data_end - ctx->ptr < 6)
+    if (bytestream2_get_bytes_left(&ctx->g) < 6)
         return AVERROR_INVALIDDATA;
-    ctx->CRC = bytestream_get_be32(&ctx->ptr);
+    ctx->CRC = bytestream2_get_be32u(&ctx->g);
 
     /* Read the frame flags if they exist */
     ctx->frameflags = 0;
     if ((ctx->fileversion > 3820) && (ctx->CRC & 0x80000000)) {
         ctx->CRC &= ~0x80000000;
 
-        if (ctx->data_end - ctx->ptr < 6)
+        if (bytestream2_get_bytes_left(&ctx->g) < 6)
             return AVERROR_INVALIDDATA;
-        ctx->frameflags = bytestream_get_be32(&ctx->ptr);
+        ctx->frameflags = bytestream2_get_be32u(&ctx->g);
     }
 
     /* Initialize the rice structs */
@@ -496,7 +493,7 @@ static int init_entropy_decoder(APEContext *ctx)
     ctx->riceY.ksum = (1 << ctx->riceY.k) * 16;
 
     /* The first 8 bits of input are ignored. */
-    ctx->ptr++;
+    bytestream2_skip(&ctx->g, 1);
 
     range_start_decoding(ctx);
 
@@ -843,21 +840,20 @@ static int ape_decode_frame(AVCodecContext *avctx, void 
*data,
             return AVERROR(ENOMEM);
         s->data = tmp_data;
         s->dsp.bswap_buf((uint32_t*)s->data, (const uint32_t*)buf, buf_size >> 
2);
-        s->ptr = s->data;
-        s->data_end = s->data + buf_size;
+        bytestream2_init(&s->g, s->data, buf_size);
 
-        nblocks = bytestream_get_be32(&s->ptr);
-        offset  = bytestream_get_be32(&s->ptr);
+        nblocks = bytestream2_get_be32(&s->g);
+        offset  = bytestream2_get_be32(&s->g);
         if (offset > 3) {
             av_log(avctx, AV_LOG_ERROR, "Incorrect offset passed\n");
             s->data = NULL;
             return AVERROR_INVALIDDATA;
         }
-        if (s->data_end - s->ptr < offset) {
+        if (bytestream2_get_bytes_left(&s->g) < offset) {
             av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
             return AVERROR_INVALIDDATA;
         }
-        s->ptr += offset;
+        bytestream2_skip(&s->g, offset);
 
         if (!nblocks || nblocks > INT_MAX) {
             av_log(avctx, AV_LOG_ERROR, "Invalid sample count: %u.\n", 
nblocks);
-- 
1.7.7.3

_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel