[Helix-client-dev] CR: 259101 - data corruption when playing corrupt SIPRO file

The code for decoding SIPRO buffers didn't validate that the destination buffer is large enough to hold the data.

Index: wrapdspr.cpp
===================================================================
RCS file: /home/helixprvt/datatype_rn/rm/audio/codec/sipro/wrapdspr.cpp,v
retrieving revision 1.2
diff -u -w -r1.2 wrapdspr.cpp
--- wrapdspr.cpp              4 Oct 2002 03:02:20 -0000              1.2
+++ wrapdspr.cpp           30 Apr 2010 21:18:43 -0000
@@ -98,6 +98,10 @@
                set_mode(mCurrentFlavor);
     }
 #ifndef _M_PC821
+    // check for buffer overflow!
+    if (prmBits <= 0 || (((inLength / prmBits) * len_frame * 8) > *pOutLength))
+        return HX_CODEC_ERROR;
+
     if (mCurrentFlavor == 0 || mCurrentFlavor == 1)
                mSipro.SLDecode((unsigned char *)in, (short *)out, inLength, &userData, mCurrentFlavor, &numItemsOut);     /* LSB is error for this frame */
     else if(mCurrentFlavor == 2)

_______________________________________________
Helix-client-dev mailing list
[email protected]
http://lists.helixcommunity.org/mailman/listinfo/helix-client-dev