Re: [PATCH]Add address overflow check

Ruikai Liu <[email protected]> Sun, 11 Feb 2018 09:04:06 +0800
Newsgroups gmane.comp.audio.compression.speex.devel
Message-ID <CAB6DpjX1WcBhmPWaF529pbym=c7MGhuqZG-mbVmh6KXyJwS6yg@mail.gmail.com>
--===============2573793910128730547==
Content-Type: multipart/alternative; boundary="089e08e5448f966b2c0564e55626"

--089e08e5448f966b2c0564e55626
Content-Type: text/plain; charset="UTF-8"

I'm not familiar with the code, but it seems that the new address is
accessed for `nb_fields`:

   end = c+length;

   len=readint(c, 0);

   c+=4;

   if (len < 0 || c+len>end)

   {

      fprintf (stderr, "Invalid/corrupted comments\n");

      return;

   }

   fwrite(c, 1, len, stderr);

   c+=len;

   fprintf (stderr, "\n");

   if (c+4>end)

   {

      fprintf (stderr, "Invalid/corrupted comments\n");

      return;

   }

   nb_fields=readint(c, 0);

So if `c+len` overflows and becomes some really small value, say `NULL`,
then `readint()` would result in segfault.

On Fri, Feb 9, 2018 at 11:56 PM, Jean-Marc Valin <[email protected]> wrote:

> Pointers are unsigned so this shouldn't be an issue. I suspect you're
> being hit by something else. That or your compiler is really broken.
>
> Cheers,
>
>         Jean-Marc
>
> On 02/09/2018 04:42 AM, Ruikai Liu wrote:
> > Hi,
> >
> > I came into a crash when using 32-bit `speexdec` and found that there's
> > an address overflow in function `print_comments()`:
> >
> > staticvoidprint_comments(char*comments, intlength)
> >
> > {
> >
> >    char*c=comments;
> >
> >    intlen, i, nb_fields;
> >
> >    char*end;
> >
> >
> >    if(length<8)
> >
> >    {
> >
> >       fprintf (stderr, "Invalid/corrupted comments\n");
> >
> >       return;
> >
> >    }
> >
> >    end = c+length;
> >
> >    len=readint(c, 0);
> >
> >    c+=4;
> >
> > // 'c+len' MAY OVERFLOW
> >
> >    if(len < 0|| c+len>end)
> >
> >    {
> >
> >       fprintf (stderr, "Invalid/corrupted comments\n");
> >
> >       return;
> >
> >    }
> >
> >
> > The pointer `c` happened to be greater than `0x80000000` and the sum
> > overflowed, even though `length` is positive.
> >
> > Here's the patch code:
> >
> > *diff --git a/src/speexdec.c b/src/speexdec.c*
> >
> > *index 4721dc1..18786f1 100644*
> >
> > *--- a/src/speexdec.c*
> >
> > *+++ b/src/speexdec.c*
> >
> > @@ -105,7 +105,7 @@static void print_comments(char *comments, int length)
> >
> >     end = c+length;
> >
> >     len=readint(c, 0);
> >
> >     c+=4;
> >
> > -   if (len < 0 || c+len>end)
> >
> > +   if (len < 0 || c+len>end || c+len<c)
> >
> >     {
> >
> >        fprintf (stderr, "Invalid/corrupted comments\n");
> >
> >        return;
> >
> > @@ -129,7 +129,7 @@static void print_comments(char *comments, int length)
> >
> >        }
> >
> >        len=readint(c, 0);
> >
> >        c+=4;
> >
> > -      if (len < 0 || c+len>end)
> >
> > +      if (len < 0 || c+len>end || c+len<c)
> >
> >        {
> >
> >           fprintf (stderr, "Invalid/corrupted comments\n");
> >
> >           return;
> >
> >
> > Thanks!
> >
> > --
> > Best regards,
> >
> > Ruikai Liu
> >
> >
> > _______________________________________________
> > Speex-dev mailing list
> > [email protected]
> > http://lists.xiph.org/mailman/listinfo/speex-dev
> >
>



-- 
Best regards,

Ruikai Liu

--089e08e5448f966b2c0564e55626
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I&#39;m not familiar with the code, but it seems that the =
new address is accessed for `nb_fields`:<div><br></div><div>




<span></span>





<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span>end =3D c+length;</spa=
n></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span>len=3Dreadint(c, </spa=
n><span class=3D"m_7291642029083108173gmail-s2" style=3D"font-variant-ligat=
ures:no-common-ligatures;color:rgb(193,53,31)">0</span><span class=3D"m_729=
1642029083108173gmail-s1" style=3D"font-variant-ligatures:no-common-ligatur=
es">);</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span>c+=3D</span><span clas=
s=3D"m_7291642029083108173gmail-s2" style=3D"font-variant-ligatures:no-comm=
on-ligatures;color:rgb(193,53,31)">4</span><span class=3D"m_729164202908310=
8173gmail-s1" style=3D"font-variant-ligatures:no-common-ligatures">;</span>=
</p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span></span><span class=3D"=
m_7291642029083108173gmail-s3" style=3D"font-variant-ligatures:no-common-li=
gatures;color:rgb(203,119,33)">if</span><span class=3D"m_729164202908310817=
3gmail-s1" style=3D"font-variant-ligatures:no-common-ligatures"> (len &lt; =
</span><span class=3D"m_7291642029083108173gmail-s2" style=3D"font-variant-=
ligatures:no-common-ligatures;color:rgb(193,53,31)">0</span><span class=3D"=
m_7291642029083108173gmail-s1" style=3D"font-variant-ligatures:no-common-li=
gatures"> || c+len&gt;end)</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span>{ <span class=3D"m_729=
1642029083108173gmail-Apple-converted-space">=C2=A0</span></span></p>
<p class=3D"m_7291642029083108173gmail-p2" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(193,53,31);background-c=
olor:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s4" style=
=3D"font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)"><span clas=
s=3D"m_7291642029083108173gmail-Apple-converted-space">=C2=A0 =C2=A0 =C2=A0=
 </span>fprintf (</span><span class=3D"m_7291642029083108173gmail-s1" style=
=3D"font-variant-ligatures:no-common-ligatures">stderr</span><span class=3D=
"m_7291642029083108173gmail-s4" style=3D"font-variant-ligatures:no-common-l=
igatures;color:rgb(0,0,0)">, </span><span class=3D"m_7291642029083108173gma=
il-s1" style=3D"font-variant-ligatures:no-common-ligatures">&quot;Invalid/c=
orrupted comments</span><span class=3D"m_7291642029083108173gmail-s5" style=
=3D"font-variant-ligatures:no-common-ligatures;color:rgb(211,56,209)">\n</s=
pan><span class=3D"m_7291642029083108173gmail-s1" style=3D"font-variant-lig=
atures:no-common-ligatures">&quot;</span><span class=3D"m_72916420290831081=
73gmail-s4" style=3D"font-variant-ligatures:no-common-ligatures;color:rgb(0=
,0,0)">);</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0 =C2=A0 =C2=A0 </span></span><span c=
lass=3D"m_7291642029083108173gmail-s3" style=3D"font-variant-ligatures:no-c=
ommon-ligatures;color:rgb(203,119,33)">return</span><span class=3D"m_729164=
2029083108173gmail-s1" style=3D"font-variant-ligatures:no-common-ligatures"=
>;</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span>}</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span>fwrite(c, </span><span=
 class=3D"m_7291642029083108173gmail-s2" style=3D"font-variant-ligatures:no=
-common-ligatures;color:rgb(193,53,31)">1</span><span class=3D"m_7291642029=
083108173gmail-s1" style=3D"font-variant-ligatures:no-common-ligatures">, l=
en, </span><span class=3D"m_7291642029083108173gmail-s2" style=3D"font-vari=
ant-ligatures:no-common-ligatures;color:rgb(193,53,31)">stderr</span><span =
class=3D"m_7291642029083108173gmail-s1" style=3D"font-variant-ligatures:no-=
common-ligatures">);</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span>c+=3Dlen;</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span>fprintf (</span><span =
class=3D"m_7291642029083108173gmail-s2" style=3D"font-variant-ligatures:no-=
common-ligatures;color:rgb(193,53,31)">stderr</span><span class=3D"m_729164=
2029083108173gmail-s1" style=3D"font-variant-ligatures:no-common-ligatures"=
>, </span><span class=3D"m_7291642029083108173gmail-s2" style=3D"font-varia=
nt-ligatures:no-common-ligatures;color:rgb(193,53,31)">&quot;</span><span c=
lass=3D"m_7291642029083108173gmail-s5" style=3D"font-variant-ligatures:no-c=
ommon-ligatures;color:rgb(211,56,209)">\n</span><span class=3D"m_7291642029=
083108173gmail-s2" style=3D"font-variant-ligatures:no-common-ligatures;colo=
r:rgb(193,53,31)">&quot;</span><span class=3D"m_7291642029083108173gmail-s1=
" style=3D"font-variant-ligatures:no-common-ligatures">);</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span></span><span class=3D"=
m_7291642029083108173gmail-s3" style=3D"font-variant-ligatures:no-common-li=
gatures;color:rgb(203,119,33)">if</span><span class=3D"m_729164202908310817=
3gmail-s1" style=3D"font-variant-ligatures:no-common-ligatures"> (c+</span>=
<span class=3D"m_7291642029083108173gmail-s2" style=3D"font-variant-ligatur=
es:no-common-ligatures;color:rgb(193,53,31)">4</span><span class=3D"m_72916=
42029083108173gmail-s1" style=3D"font-variant-ligatures:no-common-ligatures=
">&gt;end)</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span>{ <span class=3D"m_729=
1642029083108173gmail-Apple-converted-space">=C2=A0</span></span></p>
<p class=3D"m_7291642029083108173gmail-p2" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(193,53,31);background-c=
olor:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s4" style=
=3D"font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)"><span clas=
s=3D"m_7291642029083108173gmail-Apple-converted-space">=C2=A0 =C2=A0 =C2=A0=
 </span>fprintf (</span><span class=3D"m_7291642029083108173gmail-s1" style=
=3D"font-variant-ligatures:no-common-ligatures">stderr</span><span class=3D=
"m_7291642029083108173gmail-s4" style=3D"font-variant-ligatures:no-common-l=
igatures;color:rgb(0,0,0)">, </span><span class=3D"m_7291642029083108173gma=
il-s1" style=3D"font-variant-ligatures:no-common-ligatures">&quot;Invalid/c=
orrupted comments</span><span class=3D"m_7291642029083108173gmail-s5" style=
=3D"font-variant-ligatures:no-common-ligatures;color:rgb(211,56,209)">\n</s=
pan><span class=3D"m_7291642029083108173gmail-s1" style=3D"font-variant-lig=
atures:no-common-ligatures">&quot;</span><span class=3D"m_72916420290831081=
73gmail-s4" style=3D"font-variant-ligatures:no-common-ligatures;color:rgb(0=
,0,0)">);</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0 =C2=A0 =C2=A0 </span></span><span c=
lass=3D"m_7291642029083108173gmail-s3" style=3D"font-variant-ligatures:no-c=
ommon-ligatures;color:rgb(203,119,33)">return</span><span class=3D"m_729164=
2029083108173gmail-s1" style=3D"font-variant-ligatures:no-common-ligatures"=
>;</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span>}</span></p>
<p class=3D"m_7291642029083108173gmail-p1" style=3D"margin:0px;font-style:n=
ormal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:=
11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0);background-color=
:rgb(255,253,207)"><span class=3D"m_7291642029083108173gmail-s1" style=3D"f=
ont-variant-ligatures:no-common-ligatures"><span class=3D"m_729164202908310=
8173gmail-Apple-converted-space">=C2=A0=C2=A0 </span>nb_fields=3Dreadint(c,=
 </span><span class=3D"m_7291642029083108173gmail-s2" style=3D"font-variant=
-ligatures:no-common-ligatures;color:rgb(193,53,31)">0</span><span class=3D=
"m_7291642029083108173gmail-s1" style=3D"font-variant-ligatures:no-common-l=
igatures">);<span class=3D"m_7291642029083108173gmail-Apple-converted-space=
">=C2=A0</span></span></p>


<div><br></div>So if `c+len` overflows and becomes some really small value,=
 say `NULL`, then `readint()` would result in segfault.<br><div class=3D"gm=
ail_extra"><br><div class=3D"gmail_quote">On Fri, Feb 9, 2018 at 11:56 PM, =
Jean-Marc Valin <span dir=3D"ltr">&lt;<a href=3D"mailto:[email protected]"=
 target=3D"_blank">[email protected]</a>&gt;</span> wrote:<br><blockquote =
class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid=
;padding-left:1ex">Pointers are unsigned so this shouldn&#39;t be an issue.=
 I suspect you&#39;re<br>
being hit by something else. That or your compiler is really broken.<br>
<br>
Cheers,<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Jean-Marc<br>
<span><br>
On 02/09/2018 04:42 AM, Ruikai Liu wrote:<br>
&gt; Hi,<br>
&gt;<br>
&gt; I came into a crash when using 32-bit `speexdec` and found that there&=
#39;s<br>
&gt; an address overflow in function `print_comments()`:<br>
&gt;<br>
&gt; staticvoidprint_comments(char*<wbr>comments, intlength)<br>
&gt;<br>
&gt; {<br>
&gt;<br>
&gt; =C2=A0=C2=A0 char*c=3Dcomments;<br>
&gt;<br>
&gt; =C2=A0=C2=A0 intlen, i, nb_fields;<br>
&gt;<br>
&gt; =C2=A0=C2=A0 char*end;<br>
&gt;<br>
&gt;<br>
</span>&gt; =C2=A0=C2=A0 if(length&lt;8)<br>
<span>&gt;<br>
&gt; =C2=A0=C2=A0 {=C2=A0 =C2=A0<br>
&gt;<br>
&gt; =C2=A0 =C2=A0 =C2=A0 fprintf (stderr, &quot;Invalid/corrupted comments=
\n&quot;);<br>
&gt;<br>
&gt; =C2=A0 =C2=A0 =C2=A0 return;<br>
&gt;<br>
&gt; =C2=A0=C2=A0 }=C2=A0 =C2=A0<br>
&gt;<br>
&gt; =C2=A0=C2=A0 end =3D c+length;<br>
&gt;<br>
&gt; =C2=A0=C2=A0 len=3Dreadint(c, 0);=C2=A0<br>
&gt;<br>
&gt; =C2=A0=C2=A0 c+=3D4;<br>
&gt;<br>
&gt; // &#39;c+len&#39; MAY OVERFLOW<br>
&gt;<br>
</span>&gt; =C2=A0=C2=A0 if(len &lt; 0|| c+len&gt;end)<br>
<span>&gt;<br>
&gt; =C2=A0=C2=A0 {=C2=A0 =C2=A0<br>
&gt;<br>
&gt; =C2=A0 =C2=A0 =C2=A0 fprintf (stderr, &quot;Invalid/corrupted comments=
\n&quot;);<br>
&gt;<br>
&gt; =C2=A0 =C2=A0 =C2=A0 return;<br>
&gt;<br>
&gt; =C2=A0=C2=A0 }<br>
&gt;<br>
&gt;<br>
&gt; The pointer `c` happened to be greater than `0x80000000` and the sum<b=
r>
&gt; overflowed, even though `length` is positive.<br>
&gt;<br>
&gt; Here&#39;s the patch code:<br>
&gt;<br>
</span>&gt; *diff --git a/src/speexdec.c b/src/speexdec.c*<br>
&gt;<br>
&gt; *index 4721dc1..18786f1 100644*<br>
&gt;<br>
&gt; *--- a/src/speexdec.c*<br>
&gt;<br>
&gt; *+++ b/src/speexdec.c*<br>
&gt;<br>
&gt; @@ -105,7 +105,7 @@static void print_comments(char *comments, int leng=
th)<br>
<span>&gt;<br>
&gt; =C2=A0 =C2=A0 end =3D c+length;<br>
&gt;<br>
&gt; =C2=A0 =C2=A0 len=3Dreadint(c, 0);<br>
&gt;<br>
&gt; =C2=A0 =C2=A0 c+=3D4;<br>
&gt;<br>
&gt; - =C2=A0 if (len &lt; 0 || c+len&gt;end)<br>
&gt;<br>
&gt; + =C2=A0 if (len &lt; 0 || c+len&gt;end || c+len&lt;c)<br>
&gt;<br>
&gt; =C2=A0 =C2=A0 {<br>
&gt;<br>
&gt; =C2=A0=C2=A0 =C2=A0 =C2=A0 fprintf (stderr, &quot;Invalid/corrupted co=
mments\n&quot;);<br>
&gt;<br>
&gt; =C2=A0=C2=A0 =C2=A0 =C2=A0 return;<br>
&gt;<br>
</span>&gt; @@ -129,7 +129,7 @@static void print_comments(char *comments, i=
nt length)<br>
<span>&gt;<br>
&gt; =C2=A0=C2=A0 =C2=A0 =C2=A0 }<br>
&gt;<br>
&gt; =C2=A0=C2=A0 =C2=A0 =C2=A0 len=3Dreadint(c, 0);<br>
&gt;<br>
&gt; =C2=A0=C2=A0 =C2=A0 =C2=A0 c+=3D4;<br>
&gt;<br>
&gt; -=C2=A0 =C2=A0 =C2=A0 if (len &lt; 0 || c+len&gt;end)<br>
&gt;<br>
&gt; +=C2=A0 =C2=A0 =C2=A0 if (len &lt; 0 || c+len&gt;end || c+len&lt;c)<br=
>
&gt;<br>
&gt; =C2=A0=C2=A0 =C2=A0 =C2=A0 {<br>
&gt;<br>
&gt; =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 fprintf (stderr, &quot;Invalid/corr=
upted comments\n&quot;);<br>
&gt;<br>
&gt; =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 return;<br>
&gt;<br>
&gt;<br>
&gt; Thanks!<br>
&gt;<br>
&gt; --<br>
&gt; Best regards,<br>
&gt;<br>
&gt; Ruikai Liu<br>
&gt;<br>
&gt;<br>
</span>&gt; ______________________________<wbr>_________________<br>
&gt; Speex-dev mailing list<br>
&gt; <a href=3D"mailto:[email protected]" target=3D"_blank">Speex-dev@xiph=
.org</a><br>
&gt; <a href=3D"http://lists.xiph.org/mailman/listinfo/speex-dev" rel=3D"no=
referrer" target=3D"_blank">http://lists.xiph.org/mailman/<wbr>listinfo/spe=
ex-dev</a><br>
&gt;<br>
</blockquote></div><br><br clear=3D"all"><div><br></div>-- <br><div class=
=3D"m_7291642029083108173gmail_signature" data-smartmail=3D"gmail_signature=
">Best regards,<br><br>Ruikai Liu<br></div>
</div></div></div>

--089e08e5448f966b2c0564e55626--

--===============2573793910128730547==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KU3BlZXgtZGV2
IG1haWxpbmcgbGlzdApTcGVleC1kZXZAeGlwaC5vcmcKaHR0cDovL2xpc3RzLnhpcGgub3JnL21h
aWxtYW4vbGlzdGluZm8vc3BlZXgtZGV2Cg==

--===============2573793910128730547==--