Browse Source

wmalosslessdec: make MCLMS arrays big enough for what is written into them.

Fixes a part of CVE-2012-2795

CC:libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
tags/n1.1
Michael Niedermayer Anton Khirnov 14 years ago
parent
commit
607f57152c
1 changed files with 2 additions and 2 deletions
  1. +2
    -2
      libavcodec/wmalosslessdec.c

+ 2
- 2
libavcodec/wmalosslessdec.c View File

@@ -129,8 +129,8 @@ typedef struct WmallDecodeCtx {
int8_t mclms_scaling;
int16_t mclms_coeffs[128];
int16_t mclms_coeffs_cur[4];
int16_t mclms_prevvalues[64];
int16_t mclms_updates[64];
int16_t mclms_prevvalues[WMALL_MAX_CHANNELS * 2 * 32];
int16_t mclms_updates[WMALL_MAX_CHANNELS * 2 * 32];
int mclms_recent;

int movave_scaling;


Loading…
Cancel
Save