[SCM] libav/experimental: wmalosslessdec: fix mclms_coeffs* array size
siretart at users.alioth.debian.org
siretart at users.alioth.debian.org
Sun Aug 10 16:04:13 UTC 2014
The following commit has been merged in the experimental branch:
commit 849b9d34c7ef70b370c53e7af3940f51cbc07d0f
Author: Michael Niedermayer <michaelni at gmx.at>
Date: Fri Feb 7 15:07:23 2014 +0100
wmalosslessdec: fix mclms_coeffs* array size
Fixes corruption of context
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable at libav.org
Bug-Id: CVE-2014-2098
Signed-off-by: Anton Khirnov <anton at khirnov.net>
diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c
index 6ee27d3..b8a1776 100644
--- a/libavcodec/wmalosslessdec.c
+++ b/libavcodec/wmalosslessdec.c
@@ -129,8 +129,8 @@ typedef struct WmallDecodeCtx {
int8_t mclms_order;
int8_t mclms_scaling;
- int16_t mclms_coeffs[128];
- int16_t mclms_coeffs_cur[4];
+ int16_t mclms_coeffs[WMALL_MAX_CHANNELS * WMALL_MAX_CHANNELS * 32];
+ int16_t mclms_coeffs_cur[WMALL_MAX_CHANNELS * WMALL_MAX_CHANNELS];
int16_t mclms_prevvalues[WMALL_MAX_CHANNELS * 2 * 32];
int16_t mclms_updates[WMALL_MAX_CHANNELS * 2 * 32];
int mclms_recent;
--
Libav/FFmpeg packaging
More information about the pkg-multimedia-commits
mailing list