72 lines
2.4 KiB
Diff
72 lines
2.4 KiB
Diff
|
From 6b4a7cde30f2e2cb03e78ef476cc73179cfffda3 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Hugo Lefeuvre <hle@debian.org>
|
||
|
|
Date: Thu, 11 Apr 2019 09:34:07 +0200
|
||
|
|
Subject: [PATCH] sbr_hfadj: sanitize frequency band borders
|
||
|
|
|
||
|
|
user passed f_table_lim contains frequency band borders. Frequency
|
||
|
|
bands are groups of consecutive QMF channels. This means that their
|
||
|
|
bounds, as provided by f_table_lim, should never exceed MAX_M (maximum
|
||
|
|
number of QMF channels). c.f. ISO/IEC 14496-3:2001
|
||
|
|
|
||
|
|
FAAD2 does not verify this, leading to security issues when
|
||
|
|
processing files defining f_table_lim with values > MAX_M.
|
||
|
|
|
||
|
|
This patch sanitizes the values of f_table_lim so that they can be safely
|
||
|
|
used as index for Q_M_lim and G_lim arrays.
|
||
|
|
|
||
|
|
Fixes #21 (CVE-2018-20194).
|
||
|
|
|
||
|
|
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
|
||
|
|
---
|
||
|
|
Upstream status: commit 6b4a7cde30f2e
|
||
|
|
|
||
|
|
libfaad/sbr_hfadj.c | 18 ++++++++++++++++++
|
||
|
|
1 file changed, 18 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/libfaad/sbr_hfadj.c b/libfaad/sbr_hfadj.c
|
||
|
|
index 3f310b8190d7..dda1ce8e249b 100644
|
||
|
|
--- a/libfaad/sbr_hfadj.c
|
||
|
|
+++ b/libfaad/sbr_hfadj.c
|
||
|
|
@@ -485,6 +485,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch)
|
||
|
|
ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k];
|
||
|
|
ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1];
|
||
|
|
|
||
|
|
+ if (ml1 > MAX_M)
|
||
|
|
+ ml1 = MAX_M;
|
||
|
|
+
|
||
|
|
+ if (ml2 > MAX_M)
|
||
|
|
+ ml2 = MAX_M;
|
||
|
|
+
|
||
|
|
|
||
|
|
/* calculate the accumulated E_orig and E_curr over the limiter band */
|
||
|
|
for (m = ml1; m < ml2; m++)
|
||
|
|
@@ -949,6 +955,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch)
|
||
|
|
ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k];
|
||
|
|
ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1];
|
||
|
|
|
||
|
|
+ if (ml1 > MAX_M)
|
||
|
|
+ ml1 = MAX_M;
|
||
|
|
+
|
||
|
|
+ if (ml2 > MAX_M)
|
||
|
|
+ ml2 = MAX_M;
|
||
|
|
+
|
||
|
|
|
||
|
|
/* calculate the accumulated E_orig and E_curr over the limiter band */
|
||
|
|
for (m = ml1; m < ml2; m++)
|
||
|
|
@@ -1193,6 +1205,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch)
|
||
|
|
ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k];
|
||
|
|
ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1];
|
||
|
|
|
||
|
|
+ if (ml1 > MAX_M)
|
||
|
|
+ ml1 = MAX_M;
|
||
|
|
+
|
||
|
|
+ if (ml2 > MAX_M)
|
||
|
|
+ ml2 = MAX_M;
|
||
|
|
+
|
||
|
|
|
||
|
|
/* calculate the accumulated E_orig and E_curr over the limiter band */
|
||
|
|
for (m = ml1; m < ml2; m++)
|
||
|
|
--
|
||
|
|
2.20.1
|
||
|
|
|