History

Fix a segfault which occurs when memcpy is passed a bad length parameter. Thanks to David Cournapeau for the bug report.

Erik de Castro Lopo committed 17 years ago

Commit 29b71df1 parent d4f1dc22 files · +25 −10Browse files

Unified · Split

2 files
  1. ChangeLog +7 −0
  2. src/src_sinc.c +18 −10
ChangeLog+7−0
@@ -6,6 +6,13 @@ · 5 unmodified lines
66 * src/common.h
77 Add WARN_UNUSED macro.
88
9+ * src/src_sinc.c
10+ Fix a segfault which occurs when memcpy is passed a bad length parameter.
11+ This bug has zero security implications beyond the ability to cause a
12+ program hitting this bug to exit immediately with a segfault.
13+ See : http://www.mega-nerd.com/erikd/Blog/2009/Feb/14/index.html
14+ Thanks to David Cournapeau for the bug report.
15+
916 2009-02-13 Erik de Castro Lopo <erikd AT mega-nerd DOT com>
1017
1118 * src/common.h src/samplerate.c
src/src_sinc.c+18−10
@@ -79,7 +79,7 @@ static int sinc_quad_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) ; · 78 unmodified lines
7979 static int sinc_stereo_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) ;
8080 static int sinc_mono_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) ;
8181
82−static void prepare_data (SINC_FILTER *filter, SRC_DATA *data, int half_filter_chan_len) ;
82+static int prepare_data (SINC_FILTER *filter, SRC_DATA *data, int half_filter_chan_len) WARN_UNUSED ;
8383
8484 static void sinc_reset (SRC_PRIVATE *psrc) ;
8585
@@ -226,7 +226,7 @@ sinc_set_converter (SRC_PRIVATE *psrc, int src_enum) · 140 unmodified lines
226226 ** a better way. Need to look at prepare_data () at the same time.
227227 */
228228
229− temp_filter.b_len = 2 * lrint (1.0 + temp_filter.coeff_half_len / (temp_filter.index_inc * 1.0) * SRC_MAX_RATIO) ;
229+ temp_filter.b_len = lrint (2.5 * temp_filter.coeff_half_len / (temp_filter.index_inc * 1.0) * SRC_MAX_RATIO) ;
230230 temp_filter.b_len = MAX (temp_filter.b_len, 4096) ;
231231 temp_filter.b_len *= temp_filter.channels ;
232232
@@ -371,7 +371,8 @@ sinc_mono_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 138 unmodified lines
371371 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
372372
373373 if (samples_in_hand <= half_filter_chan_len)
374− { prepare_data (filter, data, half_filter_chan_len) ;
374+ { if ((psrc->error = prepare_data (filter, data, half_filter_chan_len)) != 0)
375+ return psrc->error ;
375376
376377 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
377378 if (samples_in_hand <= half_filter_chan_len)
@@ -519,7 +520,8 @@ sinc_stereo_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 141 unmodified lines
519520 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
520521
521522 if (samples_in_hand <= half_filter_chan_len)
522− { prepare_data (filter, data, half_filter_chan_len) ;
523+ { if ((psrc->error = prepare_data (filter, data, half_filter_chan_len)) != 0)
524+ return psrc->error ;
523525
524526 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
525527 if (samples_in_hand <= half_filter_chan_len)
@@ -672,7 +674,8 @@ sinc_quad_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 146 unmodified lines
672674 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
673675
674676 if (samples_in_hand <= half_filter_chan_len)
675− { prepare_data (filter, data, half_filter_chan_len) ;
677+ { if ((psrc->error = prepare_data (filter, data, half_filter_chan_len)) != 0)
678+ return psrc->error ;
676679
677680 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
678681 if (samples_in_hand <= half_filter_chan_len)
@@ -831,7 +834,8 @@ sinc_hex_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 152 unmodified lines
831834 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
832835
833836 if (samples_in_hand <= half_filter_chan_len)
834− { prepare_data (filter, data, half_filter_chan_len) ;
837+ { if ((psrc->error = prepare_data (filter, data, half_filter_chan_len)) != 0)
838+ return psrc->error ;
835839
836840 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
837841 if (samples_in_hand <= half_filter_chan_len)
@@ -1077,7 +1081,8 @@ sinc_multichan_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 239 unmodified lines
10771081 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
10781082
10791083 if (samples_in_hand <= half_filter_chan_len)
1080− { prepare_data (filter, data, half_filter_chan_len) ;
1084+ { if ((psrc->error = prepare_data (filter, data, half_filter_chan_len)) != 0)
1085+ return psrc->error ;
10811086
10821087 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
10831088 if (samples_in_hand <= half_filter_chan_len)
@@ -1126,12 +1131,12 @@ sinc_multichan_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 42 unmodified lines
11261131 /*----------------------------------------------------------------------------------------
11271132 */
11281133
1129−static void
1134+static int
11301135 prepare_data (SINC_FILTER *filter, SRC_DATA *data, int half_filter_chan_len)
11311136 { int len = 0 ;
11321137
11331138 if (filter->b_real_end >= 0)
1134− return ; /* This doesn't make sense, so return. */
1139+ return 0 ; /* Should be terminating. Just return. */
11351140
11361141 if (filter->b_current == 0)
11371142 { /* Initial state. Set up zeros at the start of the buffer and
@@ -1161,6 +1166,9 @@ prepare_data (SINC_FILTER *filter, SRC_DATA *data, int half_filter_chan_len) · 23 unmodified lines
11611166 len = MIN (filter->in_count - filter->in_used, len) ;
11621167 len -= (len % filter->channels) ;
11631168
1169+ if (len < 0 || filter->b_end + len > filter->b_len)
1170+ return SRC_ERR_SINC_PREPARE_DATA_BAD_LEN ;
1171+
11641172 memcpy (filter->buffer + filter->b_end, data->data_in + filter->in_used,
11651173 len * sizeof (filter->buffer [0])) ;
11661174
@@ -1190,7 +1198,7 @@ prepare_data (SINC_FILTER *filter, SRC_DATA *data, int half_filter_chan_len) · 23 unmodified lines
11901198 filter->b_end += len ;
11911199 } ;
11921200
1193− return ;
1201+ return 0 ;
11941202 } /* prepare_data */
11951203
11961204

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t