Re: Multiple bugs/vulns(?)

I just took a look, which I probably should have done from the start.
It seems that this is due to not checking 'j2', to see whether it is an
appropriate number.


With the code:

y = (j2 < 0) ? inbuf_old[BLACKSIZE + j2] : inbuf[j2];

> (gdb) p BLACKSIZE
> $2 = 32
> (gdb) p j2
> $3 = -268445
Since '-268445 < 0' is try, it will set ' y = inbuf_old[BLACKSIZE + j2]'.
y = intbuf_old[-268413] is going to cause problems.



Just my 2-cents on the matter anyways. I don't really understand the code.


Thanks,
-- 
-- Joshua Rogers <https://internot.info/>

------------------------------------------------------------------------------

_______________________________________________
Lame-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/lame-dev