[Helix-client-dev] CR: 259182 - potential security exploit

This was a case of trying to delete memory that wasn't ever allocated.  The cause was uninitialized class variables.
The fix below fixes this problem along with a number of related potential others.

Index: fixpt/decoder/hxwrapper/gecko2decshim.cpp
===================================================================
RCS file: /cvsroot/rarvcode-audio/codec/ra8lbr/fixpt/decoder/hxwrapper/gecko2decshim.cpp,v
retrieving revision 1.4.58.1
diff -u -w -r1.4.58.1 gecko2decshim.cpp
--- fixpt/decoder/hxwrapper/gecko2decshim.cpp           27 Apr 2005 19:26:10 -0000           1.4.58.1
+++ fixpt/decoder/hxwrapper/gecko2decshim.cpp        23 Apr 2010 22:20:17 -0000
@@ -74,7 +74,13 @@
   return HXR_OK ;
 }

-COldGeckoDecoderShim::COldGeckoDecoderShim() {}
+COldGeckoDecoderShim::COldGeckoDecoderShim():
+    mChannels(0),
+    mFrameSamples(0),
+    mFrameBytes(0),
+    mInterleaveBuffer(NULL),
+    codecs(NULL)
+{}
 COldGeckoDecoderShim::~COldGeckoDecoderShim(){}

 HX_RESULT COldGeckoDecoderShim::InitDecoder(int sampleRate, int nChannels, int nFrameBits, BYTE *pOpaqueData, int opaqueDataLength, int &codingDelay)
@@ -152,7 +158,11 @@

 /* the shim for the new codec is rather thin in fact */

-CNewGeckoDecoderShim::CNewGeckoDecoderShim() {}
+CNewGeckoDecoderShim::CNewGeckoDecoderShim():
+    mFrameBits(0),
+    mSamplesPerFrame(0),
+    pCodec(NULL)
+{}
 CNewGeckoDecoderShim::~CNewGeckoDecoderShim(){}

 HX_RESULT CNewGeckoDecoderShim::InitDecoder(int sampleRate, int nChannels, int nFrameBits, BYTE *pOpaqueData, int opaqueDataLength, int &codingDelay)
Index: fltpt/decoder/gecko2decshim.cpp
===================================================================
RCS file: /cvsroot/rarvcode-audio/codec/ra8lbr/fltpt/decoder/gecko2decshim.cpp,v
retrieving revision 1.4.58.1
diff -u -w -r1.4.58.1 gecko2decshim.cpp
--- fltpt/decoder/gecko2decshim.cpp    27 Apr 2005 19:26:36 -0000           1.4.58.1
+++ fltpt/decoder/gecko2decshim.cpp 23 Apr 2010 22:20:17 -0000
@@ -82,7 +82,13 @@
   return HXR_OK ;
 }

-COldGeckoDecoderShim::COldGeckoDecoderShim() {}
+COldGeckoDecoderShim::COldGeckoDecoderShim():
+    mChannels(0),
+    mFrameSamples(0),
+    mFrameBytes(0),
+    mInterleaveBuffer(NULL),
+    codecs(NULL)
+{}
 COldGeckoDecoderShim::~COldGeckoDecoderShim(){}

 HX_RESULT COldGeckoDecoderShim::InitDecoder(int sampleRate, int nChannels, int nFrameBits, BYTE *pOpaqueData, int opaqueDataLength, int &codingDelay)
@@ -184,7 +190,11 @@

 /* the shim for the new codec is rather thin in fact */

-CNewGeckoDecoderShim::CNewGeckoDecoderShim() {}
+CNewGeckoDecoderShim::CNewGeckoDecoderShim():
+    mFrameBits(0),
+    mSamplesPerFrame(0),
+    pCodec(NULL)
+{}
 CNewGeckoDecoderShim::~CNewGeckoDecoderShim(){}

 HX_RESULT CNewGeckoDecoderShim::InitDecoder(int sampleRate, int nChannels, int nFrameBits, BYTE *pOpaqueData, int opaqueDataLength, int &codingDelay)
@@ -219,7 +229,14 @@
 }

 /* multi channel decoder */
-CGeckoMCDecoderShim::CGeckoMCDecoderShim() {}
+CGeckoMCDecoderShim::CGeckoMCDecoderShim():
+    mNumCodecs(0),
+    mTotalBytes(0),
+    mChannelsTotal(0),
+    mSamplesPerFrame(0),
+    mInterleaveBuffer(NULL),
+    codecs(NULL)
+{}
 CGeckoMCDecoderShim::~CGeckoMCDecoderShim(){}

 HX_RESULT CGeckoMCDecoderShim::InitDecoder(int sampleRate, int nChannels, int nFrameBits, BYTE *pOpaqueData, int opaqueDataLength, int &codingDelay)

_______________________________________________
Helix-client-dev mailing list
[email protected]
http://lists.helixcommunity.org/mailman/listinfo/helix-client-dev