[Helix-client-dev] RE: 259101 - data corruption when playing corrupt SIPRO file

You could potentially overflow on the calculation

inLength / prmBits * len_frame * 8

which would then make you skip the error branch. Not sure if that causes problems in this code or not, but maybe safer as

inLength / prmBits > *pOutLength / len_frame / 8


-jpf



________________________________
From: Steve Blanding
Sent: Friday, April 30, 2010 2:29 PM
To: [email protected]; [email protected]
Subject: CR: 259101 - data corruption when playing corrupt SIPRO file

The code for decoding SIPRO buffers didn't validate that the destination buffer is large enough to hold the data.

Index: wrapdspr.cpp
===================================================================
RCS file: /home/helixprvt/datatype_rn/rm/audio/codec/sipro/wrapdspr.cpp,v
retrieving revision 1.2
diff -u -w -r1.2 wrapdspr.cpp
--- wrapdspr.cpp              4 Oct 2002 03:02:20 -0000              1.2
+++ wrapdspr.cpp           30 Apr 2010 21:18:43 -0000
@@ -98,6 +98,10 @@
                set_mode(mCurrentFlavor);
     }
 #ifndef _M_PC821
+    // check for buffer overflow!
+    if (prmBits <= 0 || (((inLength / prmBits) * len_frame * 8) > *pOutLength))
+        return HX_CODEC_ERROR;
+
     if (mCurrentFlavor == 0 || mCurrentFlavor == 1)
                mSipro.SLDecode((unsigned char *)in, (short *)out, inLength, &userData, mCurrentFlavor, &numItemsOut);     /* LSB is error for this frame */
     else if(mCurrentFlavor == 2)

_______________________________________________
Helix-client-dev mailing list
[email protected]
http://lists.helixcommunity.org/mailman/listinfo/helix-client-dev