[libav-commits] wmalosslessdec: make MCLMS arrays big enough for what is written into them.

Michael Niedermayer git at libav.org
Sat Sep 29 19:21:26 CEST 2012


Module: libav
Branch: master
Commit: 607f57152c59bcec26caaf2060a86d96f76c4e8b

Author:    Michael Niedermayer <michaelni at gmx.at>
Committer: Anton Khirnov <anton at khirnov.net>
Date:      Sat Apr 14 14:49:22 2012 +0200

wmalosslessdec: make MCLMS arrays big enough for what is written into them.

Fixes a part of CVE-2012-2795

CC:libav-stable at libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton at khirnov.net>

---

 libavcodec/wmalosslessdec.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c
index c67a392..cfa877f 100644
--- a/libavcodec/wmalosslessdec.c
+++ b/libavcodec/wmalosslessdec.c
@@ -129,8 +129,8 @@ typedef struct WmallDecodeCtx {
     int8_t  mclms_scaling;
     int16_t mclms_coeffs[128];
     int16_t mclms_coeffs_cur[4];
-    int16_t mclms_prevvalues[64];
-    int16_t mclms_updates[64];
+    int16_t mclms_prevvalues[WMALL_MAX_CHANNELS * 2 * 32];
+    int16_t mclms_updates[WMALL_MAX_CHANNELS * 2 * 32];
     int     mclms_recent;
 
     int     movave_scaling;



More information about the libav-commits mailing list