Re: Multiple bugs/vulns(?)

On 08/11/14 02:48, Joshua Rogers wrote:
> With the code:
>
> y = (j2 < 0) ? inbuf_old[BLACKSIZE + j2] : inbuf[j2];
>
>> (gdb) p BLACKSIZE
>> $2 = 32
>> (gdb) p j2
>> $3 = -268445
> Since '-268445 < 0' is try, it will set ' y = inbuf_old[BLACKSIZE + j2]'.
> y = intbuf_old[-268413] is going to cause problems.
>
>
Offending code variable is: cfg->samplerate_in

> (gdb) p j
> $2 = -268430
> (gdb) p i
> $3 = 0
> (gdb) p filter_l
> $4 = 31
> (gdb) p time0
> $5 = -268429.94349999999
> (gdb) p k
> $6 = 1
> (gdb) p resample_ratio
> $7 = -268429.94349999999
> (gdb) p cfg->samplerate_in
> $8 = -2147439548
> (gdb) p cfg->samplerate_out
> $9 = 8000

Arbitrary samplerate = buffer/int overflow, it would appear.
I won't look any further at this, just incase I'm heading down the wrong
track.


Thanks again,
-- 
-- Joshua Rogers <https://internot.info/>

------------------------------------------------------------------------------

_______________________________________________
Lame-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/lame-dev