Commit 9def5c46 authored by Michael Niedermayer's avatar Michael Niedermayer Committed by Reinhard Tartler

shorten: Use separate pointers for the allocated memory for decoded samples.

Fixes invalid free() if any of the buffers are not allocated due to either
not decoding a header or an error prior to allocating all buffers.

Fixes CVE-2012-0858
CC: libav-stable@libav.org
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
Signed-off-by: 's avatarJustin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 204cb29b)
Signed-off-by: 's avatarReinhard Tartler <siretart@tauware.de>
parent 7aeb281a
......@@ -82,6 +82,7 @@ typedef struct ShortenContext {
int channels;
int32_t *decoded[MAX_CHANNELS];
int32_t *decoded_base[MAX_CHANNELS];
int32_t *offset[MAX_CHANNELS];
uint8_t *bitstream;
int bitstream_size;
......@@ -129,13 +130,14 @@ static int allocate_buffers(ShortenContext *s)
return AVERROR(ENOMEM);
s->offset[chan] = tmp_ptr;
tmp_ptr = av_realloc(s->decoded[chan], sizeof(int32_t)*(s->blocksize + s->nwrap));
tmp_ptr = av_realloc(s->decoded_base[chan], (s->blocksize + s->nwrap) *
sizeof(s->decoded_base[0][0]));
if (!tmp_ptr)
return AVERROR(ENOMEM);
s->decoded[chan] = tmp_ptr;
s->decoded_base[chan] = tmp_ptr;
for (i=0; i<s->nwrap; i++)
s->decoded[chan][i] = 0;
s->decoded[chan] += s->nwrap;
s->decoded_base[chan][i] = 0;
s->decoded[chan] = s->decoded_base[chan] + s->nwrap;
}
return 0;
}
......@@ -523,8 +525,8 @@ static av_cold int shorten_decode_close(AVCodecContext *avctx)
int i;
for (i = 0; i < s->channels; i++) {
s->decoded[i] -= s->nwrap;
av_freep(&s->decoded[i]);
s->decoded[i] = NULL;
av_freep(&s->decoded_base[i]);
av_freep(&s->offset[i]);
}
av_freep(&s->bitstream);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment