History

Fix a segfault which occurs when memcpy is passed a bad length parameter. Thanks to David Cournapeau for the bug report.

Erik de Castro Lopo committed 17 years ago

Commit 29b71df1 parent d4f1dc22 files · +25 −10Browse files

Unified · Split

2 files
  1. ChangeLog +7 −0
  2. src/src_sinc.c +18 −10
ChangeLog+7−0
@@ -6,6 +6,13 @@ · 5 unmodified lines
6 * src/common.h6 * src/common.h
7 Add WARN_UNUSED macro.7 Add WARN_UNUSED macro.
8 8
9 * src/src_sinc.c
10 Fix a segfault which occurs when memcpy is passed a bad length parameter.
11 This bug has zero security implications beyond the ability to cause a
12 program hitting this bug to exit immediately with a segfault.
13 See : http://www.mega-nerd.com/erikd/Blog/2009/Feb/14/index.html
14 Thanks to David Cournapeau for the bug report.
15
92009-02-13 Erik de Castro Lopo <erikd AT mega-nerd DOT com>162009-02-13 Erik de Castro Lopo <erikd AT mega-nerd DOT com>
10 17
11 * src/common.h src/samplerate.c18 * src/common.h src/samplerate.c
src/src_sinc.c+18−10
@@ -79,7 +79,7 @@ static int sinc_quad_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) ; · 78 unmodified lines
79static int sinc_stereo_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) ;79static int sinc_stereo_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) ;
80static int sinc_mono_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) ;80static int sinc_mono_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) ;
81 81
82static void prepare_data (SINC_FILTER *filter, SRC_DATA *data, int half_filter_chan_len) ;82static int prepare_data (SINC_FILTER *filter, SRC_DATA *data, int half_filter_chan_len) WARN_UNUSED ;
83 83
84static void sinc_reset (SRC_PRIVATE *psrc) ;84static void sinc_reset (SRC_PRIVATE *psrc) ;
85 85
@@ -226,7 +226,7 @@ sinc_set_converter (SRC_PRIVATE *psrc, int src_enum) · 140 unmodified lines
226 ** a better way. Need to look at prepare_data () at the same time.226 ** a better way. Need to look at prepare_data () at the same time.
227 */227 */
228 228
229 temp_filter.b_len = 2 * lrint (1.0 + temp_filter.coeff_half_len / (temp_filter.index_inc * 1.0) * SRC_MAX_RATIO) ;229 temp_filter.b_len = lrint (2.5 * temp_filter.coeff_half_len / (temp_filter.index_inc * 1.0) * SRC_MAX_RATIO) ;
230 temp_filter.b_len = MAX (temp_filter.b_len, 4096) ;230 temp_filter.b_len = MAX (temp_filter.b_len, 4096) ;
231 temp_filter.b_len *= temp_filter.channels ;231 temp_filter.b_len *= temp_filter.channels ;
232 232
@@ -371,7 +371,8 @@ sinc_mono_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 138 unmodified lines
371 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;371 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
372 372
373 if (samples_in_hand <= half_filter_chan_len)373 if (samples_in_hand <= half_filter_chan_len)
374 { prepare_data (filter, data, half_filter_chan_len) ;374 { if ((psrc->error = prepare_data (filter, data, half_filter_chan_len)) != 0)
375 return psrc->error ;
375 376
376 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;377 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
377 if (samples_in_hand <= half_filter_chan_len)378 if (samples_in_hand <= half_filter_chan_len)
@@ -519,7 +520,8 @@ sinc_stereo_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 141 unmodified lines
519 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;520 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
520 521
521 if (samples_in_hand <= half_filter_chan_len)522 if (samples_in_hand <= half_filter_chan_len)
522 { prepare_data (filter, data, half_filter_chan_len) ;523 { if ((psrc->error = prepare_data (filter, data, half_filter_chan_len)) != 0)
524 return psrc->error ;
523 525
524 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;526 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
525 if (samples_in_hand <= half_filter_chan_len)527 if (samples_in_hand <= half_filter_chan_len)
@@ -672,7 +674,8 @@ sinc_quad_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 146 unmodified lines
672 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;674 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
673 675
674 if (samples_in_hand <= half_filter_chan_len)676 if (samples_in_hand <= half_filter_chan_len)
675 { prepare_data (filter, data, half_filter_chan_len) ;677 { if ((psrc->error = prepare_data (filter, data, half_filter_chan_len)) != 0)
678 return psrc->error ;
676 679
677 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;680 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
678 if (samples_in_hand <= half_filter_chan_len)681 if (samples_in_hand <= half_filter_chan_len)
@@ -831,7 +834,8 @@ sinc_hex_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 152 unmodified lines
831 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;834 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
832 835
833 if (samples_in_hand <= half_filter_chan_len)836 if (samples_in_hand <= half_filter_chan_len)
834 { prepare_data (filter, data, half_filter_chan_len) ;837 { if ((psrc->error = prepare_data (filter, data, half_filter_chan_len)) != 0)
838 return psrc->error ;
835 839
836 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;840 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
837 if (samples_in_hand <= half_filter_chan_len)841 if (samples_in_hand <= half_filter_chan_len)
@@ -1077,7 +1081,8 @@ sinc_multichan_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 239 unmodified lines
1077 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;1081 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
1078 1082
1079 if (samples_in_hand <= half_filter_chan_len)1083 if (samples_in_hand <= half_filter_chan_len)
1080 { prepare_data (filter, data, half_filter_chan_len) ;1084 { if ((psrc->error = prepare_data (filter, data, half_filter_chan_len)) != 0)
1085 return psrc->error ;
1081 1086
1082 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;1087 samples_in_hand = (filter->b_end - filter->b_current + filter->b_len) % filter->b_len ;
1083 if (samples_in_hand <= half_filter_chan_len)1088 if (samples_in_hand <= half_filter_chan_len)
@@ -1126,12 +1131,12 @@ sinc_multichan_vari_process (SRC_PRIVATE *psrc, SRC_DATA *data) · 42 unmodified lines
1126/*----------------------------------------------------------------------------------------1131/*----------------------------------------------------------------------------------------
1127*/1132*/
1128 1133
1129static void1134static int
1130prepare_data (SINC_FILTER *filter, SRC_DATA *data, int half_filter_chan_len)1135prepare_data (SINC_FILTER *filter, SRC_DATA *data, int half_filter_chan_len)
1131{ int len = 0 ;1136{ int len = 0 ;
1132 1137
1133 if (filter->b_real_end >= 0)1138 if (filter->b_real_end >= 0)
1134 return ; /* This doesn't make sense, so return. */1139 return 0 ; /* Should be terminating. Just return. */
1135 1140
1136 if (filter->b_current == 0)1141 if (filter->b_current == 0)
1137 { /* Initial state. Set up zeros at the start of the buffer and1142 { /* Initial state. Set up zeros at the start of the buffer and
@@ -1161,6 +1166,9 @@ prepare_data (SINC_FILTER *filter, SRC_DATA *data, int half_filter_chan_len) · 23 unmodified lines
1161 len = MIN (filter->in_count - filter->in_used, len) ;1166 len = MIN (filter->in_count - filter->in_used, len) ;
1162 len -= (len % filter->channels) ;1167 len -= (len % filter->channels) ;
1163 1168
1169 if (len < 0 || filter->b_end + len > filter->b_len)
1170 return SRC_ERR_SINC_PREPARE_DATA_BAD_LEN ;
1171
1164 memcpy (filter->buffer + filter->b_end, data->data_in + filter->in_used,1172 memcpy (filter->buffer + filter->b_end, data->data_in + filter->in_used,
1165 len * sizeof (filter->buffer [0])) ;1173 len * sizeof (filter->buffer [0])) ;
1166 1174
@@ -1190,7 +1198,7 @@ prepare_data (SINC_FILTER *filter, SRC_DATA *data, int half_filter_chan_len) · 23 unmodified lines
1190 filter->b_end += len ;1198 filter->b_end += len ;
1191 } ;1199 } ;
1192 1200
1193 return ;1201 return 0 ;
1194} /* prepare_data */1202} /* prepare_data */
1195 1203
1196 1204

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t