You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
817 lines
24 KiB
817 lines
24 KiB
From: Kurt Roeckx <kurt@roeckx.be> |
|
Date: Sun, 28 Jan 2018 19:26:36 +0100 |
|
Subject: Check the size before reading with mad_bit_read |
|
|
|
There are various cases where it attemps to read past the end of the buffer |
|
using mad_bit_read(). Most functions didn't even know the size of the buffer |
|
they were reading from. |
|
|
|
Index: libmad-0.15.1b/bit.c |
|
=================================================================== |
|
--- libmad-0.15.1b.orig/bit.c |
|
+++ libmad-0.15.1b/bit.c |
|
@@ -138,6 +138,9 @@ unsigned long mad_bit_read(struct mad_bi |
|
{ |
|
register unsigned long value; |
|
|
|
+ if (len == 0) |
|
+ return 0; |
|
+ |
|
if (bitptr->left == CHAR_BIT) |
|
bitptr->cache = *bitptr->byte; |
|
|
|
Index: libmad-0.15.1b/frame.c |
|
=================================================================== |
|
--- libmad-0.15.1b.orig/frame.c |
|
+++ libmad-0.15.1b/frame.c |
|
@@ -120,11 +120,18 @@ static |
|
int decode_header(struct mad_header *header, struct mad_stream *stream) |
|
{ |
|
unsigned int index; |
|
+ struct mad_bitptr bufend_ptr; |
|
|
|
header->flags = 0; |
|
header->private_bits = 0; |
|
|
|
+ mad_bit_init(&bufend_ptr, stream->bufend); |
|
+ |
|
/* header() */ |
|
+ if (mad_bit_length(&stream->ptr, &bufend_ptr) < 32) { |
|
+ stream->error = MAD_ERROR_BUFLEN; |
|
+ return -1; |
|
+ } |
|
|
|
/* syncword */ |
|
mad_bit_skip(&stream->ptr, 11); |
|
@@ -225,8 +232,13 @@ int decode_header(struct mad_header *hea |
|
/* error_check() */ |
|
|
|
/* crc_check */ |
|
- if (header->flags & MAD_FLAG_PROTECTION) |
|
+ if (header->flags & MAD_FLAG_PROTECTION) { |
|
+ if (mad_bit_length(&stream->ptr, &bufend_ptr) < 16) { |
|
+ stream->error = MAD_ERROR_BUFLEN; |
|
+ return -1; |
|
+ } |
|
header->crc_target = mad_bit_read(&stream->ptr, 16); |
|
+ } |
|
|
|
return 0; |
|
} |
|
@@ -338,7 +350,7 @@ int mad_header_decode(struct mad_header |
|
stream->error = MAD_ERROR_BUFLEN; |
|
goto fail; |
|
} |
|
- else if (!(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) { |
|
+ else if ((end - ptr >= 2) && !(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) { |
|
/* mark point where frame sync word was expected */ |
|
stream->this_frame = ptr; |
|
stream->next_frame = ptr + 1; |
|
@@ -361,6 +373,8 @@ int mad_header_decode(struct mad_header |
|
ptr = mad_bit_nextbyte(&stream->ptr); |
|
} |
|
|
|
+ stream->error = MAD_ERROR_NONE; |
|
+ |
|
/* begin processing */ |
|
stream->this_frame = ptr; |
|
stream->next_frame = ptr + 1; /* possibly bogus sync word */ |
|
@@ -413,7 +427,7 @@ int mad_header_decode(struct mad_header |
|
/* check that a valid frame header follows this frame */ |
|
|
|
ptr = stream->next_frame; |
|
- if (!(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) { |
|
+ if ((end - ptr >= 2) && !(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) { |
|
ptr = stream->next_frame = stream->this_frame + 1; |
|
goto sync; |
|
} |
|
Index: libmad-0.15.1b/layer12.c |
|
=================================================================== |
|
--- libmad-0.15.1b.orig/layer12.c |
|
+++ libmad-0.15.1b/layer12.c |
|
@@ -72,10 +72,18 @@ mad_fixed_t const linear_table[14] = { |
|
* DESCRIPTION: decode one requantized Layer I sample from a bitstream |
|
*/ |
|
static |
|
-mad_fixed_t I_sample(struct mad_bitptr *ptr, unsigned int nb) |
|
+mad_fixed_t I_sample(struct mad_bitptr *ptr, unsigned int nb, struct mad_stream *stream) |
|
{ |
|
mad_fixed_t sample; |
|
+ struct mad_bitptr frameend_ptr; |
|
|
|
+ mad_bit_init(&frameend_ptr, stream->next_frame); |
|
+ |
|
+ if (mad_bit_length(ptr, &frameend_ptr) < nb) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return 0; |
|
+ } |
|
sample = mad_bit_read(ptr, nb); |
|
|
|
/* invert most significant bit, extend sign, then scale to fixed format */ |
|
@@ -106,6 +114,10 @@ int mad_layer_I(struct mad_stream *strea |
|
struct mad_header *header = &frame->header; |
|
unsigned int nch, bound, ch, s, sb, nb; |
|
unsigned char allocation[2][32], scalefactor[2][32]; |
|
+ struct mad_bitptr bufend_ptr, frameend_ptr; |
|
+ |
|
+ mad_bit_init(&bufend_ptr, stream->bufend); |
|
+ mad_bit_init(&frameend_ptr, stream->next_frame); |
|
|
|
nch = MAD_NCHANNELS(header); |
|
|
|
@@ -118,6 +130,11 @@ int mad_layer_I(struct mad_stream *strea |
|
/* check CRC word */ |
|
|
|
if (header->flags & MAD_FLAG_PROTECTION) { |
|
+ if (mad_bit_length(&stream->ptr, &bufend_ptr) |
|
+ < 4 * (bound * nch + (32 - bound))) { |
|
+ stream->error = MAD_ERROR_BADCRC; |
|
+ return -1; |
|
+ } |
|
header->crc_check = |
|
mad_bit_crc(stream->ptr, 4 * (bound * nch + (32 - bound)), |
|
header->crc_check); |
|
@@ -133,6 +150,11 @@ int mad_layer_I(struct mad_stream *strea |
|
|
|
for (sb = 0; sb < bound; ++sb) { |
|
for (ch = 0; ch < nch; ++ch) { |
|
+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 4) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return -1; |
|
+ } |
|
nb = mad_bit_read(&stream->ptr, 4); |
|
|
|
if (nb == 15) { |
|
@@ -145,6 +167,11 @@ int mad_layer_I(struct mad_stream *strea |
|
} |
|
|
|
for (sb = bound; sb < 32; ++sb) { |
|
+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 4) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return -1; |
|
+ } |
|
nb = mad_bit_read(&stream->ptr, 4); |
|
|
|
if (nb == 15) { |
|
@@ -161,6 +188,11 @@ int mad_layer_I(struct mad_stream *strea |
|
for (sb = 0; sb < 32; ++sb) { |
|
for (ch = 0; ch < nch; ++ch) { |
|
if (allocation[ch][sb]) { |
|
+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return -1; |
|
+ } |
|
scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6); |
|
|
|
# if defined(OPT_STRICT) |
|
@@ -185,8 +217,10 @@ int mad_layer_I(struct mad_stream *strea |
|
for (ch = 0; ch < nch; ++ch) { |
|
nb = allocation[ch][sb]; |
|
frame->sbsample[ch][s][sb] = nb ? |
|
- mad_f_mul(I_sample(&stream->ptr, nb), |
|
+ mad_f_mul(I_sample(&stream->ptr, nb, stream), |
|
sf_table[scalefactor[ch][sb]]) : 0; |
|
+ if (stream->error != 0) |
|
+ return -1; |
|
} |
|
} |
|
|
|
@@ -194,7 +228,14 @@ int mad_layer_I(struct mad_stream *strea |
|
if ((nb = allocation[0][sb])) { |
|
mad_fixed_t sample; |
|
|
|
- sample = I_sample(&stream->ptr, nb); |
|
+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < nb) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return -1; |
|
+ } |
|
+ sample = I_sample(&stream->ptr, nb, stream); |
|
+ if (stream->error != 0) |
|
+ return -1; |
|
|
|
for (ch = 0; ch < nch; ++ch) { |
|
frame->sbsample[ch][s][sb] = |
|
@@ -280,13 +321,21 @@ struct quantclass { |
|
static |
|
void II_samples(struct mad_bitptr *ptr, |
|
struct quantclass const *quantclass, |
|
- mad_fixed_t output[3]) |
|
+ mad_fixed_t output[3], struct mad_stream *stream) |
|
{ |
|
unsigned int nb, s, sample[3]; |
|
+ struct mad_bitptr frameend_ptr; |
|
+ |
|
+ mad_bit_init(&frameend_ptr, stream->next_frame); |
|
|
|
if ((nb = quantclass->group)) { |
|
unsigned int c, nlevels; |
|
|
|
+ if (mad_bit_length(ptr, &frameend_ptr) < quantclass->bits) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return; |
|
+ } |
|
/* degrouping */ |
|
c = mad_bit_read(ptr, quantclass->bits); |
|
nlevels = quantclass->nlevels; |
|
@@ -299,8 +348,14 @@ void II_samples(struct mad_bitptr *ptr, |
|
else { |
|
nb = quantclass->bits; |
|
|
|
- for (s = 0; s < 3; ++s) |
|
+ for (s = 0; s < 3; ++s) { |
|
+ if (mad_bit_length(ptr, &frameend_ptr) < nb) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return; |
|
+ } |
|
sample[s] = mad_bit_read(ptr, nb); |
|
+ } |
|
} |
|
|
|
for (s = 0; s < 3; ++s) { |
|
@@ -336,6 +391,9 @@ int mad_layer_II(struct mad_stream *stre |
|
unsigned char const *offsets; |
|
unsigned char allocation[2][32], scfsi[2][32], scalefactor[2][32][3]; |
|
mad_fixed_t samples[3]; |
|
+ struct mad_bitptr frameend_ptr; |
|
+ |
|
+ mad_bit_init(&frameend_ptr, stream->next_frame); |
|
|
|
nch = MAD_NCHANNELS(header); |
|
|
|
@@ -402,13 +460,24 @@ int mad_layer_II(struct mad_stream *stre |
|
for (sb = 0; sb < bound; ++sb) { |
|
nbal = bitalloc_table[offsets[sb]].nbal; |
|
|
|
- for (ch = 0; ch < nch; ++ch) |
|
+ for (ch = 0; ch < nch; ++ch) { |
|
+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < nbal) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return -1; |
|
+ } |
|
allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal); |
|
+ } |
|
} |
|
|
|
for (sb = bound; sb < sblimit; ++sb) { |
|
nbal = bitalloc_table[offsets[sb]].nbal; |
|
|
|
+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < nbal) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return -1; |
|
+ } |
|
allocation[0][sb] = |
|
allocation[1][sb] = mad_bit_read(&stream->ptr, nbal); |
|
} |
|
@@ -417,8 +486,14 @@ int mad_layer_II(struct mad_stream *stre |
|
|
|
for (sb = 0; sb < sblimit; ++sb) { |
|
for (ch = 0; ch < nch; ++ch) { |
|
- if (allocation[ch][sb]) |
|
+ if (allocation[ch][sb]) { |
|
+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 2) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return -1; |
|
+ } |
|
scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2); |
|
+ } |
|
} |
|
} |
|
|
|
@@ -441,6 +516,11 @@ int mad_layer_II(struct mad_stream *stre |
|
for (sb = 0; sb < sblimit; ++sb) { |
|
for (ch = 0; ch < nch; ++ch) { |
|
if (allocation[ch][sb]) { |
|
+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return -1; |
|
+ } |
|
scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6); |
|
|
|
switch (scfsi[ch][sb]) { |
|
@@ -451,11 +531,21 @@ int mad_layer_II(struct mad_stream *stre |
|
break; |
|
|
|
case 0: |
|
+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return -1; |
|
+ } |
|
scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6); |
|
/* fall through */ |
|
|
|
case 1: |
|
case 3: |
|
+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) { |
|
+ stream->error = MAD_ERROR_LOSTSYNC; |
|
+ stream->sync = 0; |
|
+ return -1; |
|
+ } |
|
scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6); |
|
} |
|
|
|
@@ -487,7 +577,9 @@ int mad_layer_II(struct mad_stream *stre |
|
if ((index = allocation[ch][sb])) { |
|
index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1]; |
|
|
|
- II_samples(&stream->ptr, &qc_table[index], samples); |
|
+ II_samples(&stream->ptr, &qc_table[index], samples, stream); |
|
+ if (stream->error != 0) |
|
+ return -1; |
|
|
|
for (s = 0; s < 3; ++s) { |
|
frame->sbsample[ch][3 * gr + s][sb] = |
|
@@ -505,7 +597,9 @@ int mad_layer_II(struct mad_stream *stre |
|
if ((index = allocation[0][sb])) { |
|
index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1]; |
|
|
|
- II_samples(&stream->ptr, &qc_table[index], samples); |
|
+ II_samples(&stream->ptr, &qc_table[index], samples, stream); |
|
+ if (stream->error != 0) |
|
+ return -1; |
|
|
|
for (ch = 0; ch < nch; ++ch) { |
|
for (s = 0; s < 3; ++s) { |
|
Index: libmad-0.15.1b/layer3.c |
|
=================================================================== |
|
--- libmad-0.15.1b.orig/layer3.c |
|
+++ libmad-0.15.1b/layer3.c |
|
@@ -598,7 +598,8 @@ enum mad_error III_sideinfo(struct mad_b |
|
static |
|
unsigned int III_scalefactors_lsf(struct mad_bitptr *ptr, |
|
struct channel *channel, |
|
- struct channel *gr1ch, int mode_extension) |
|
+ struct channel *gr1ch, int mode_extension, |
|
+ unsigned int bits_left, unsigned int *part2_length) |
|
{ |
|
struct mad_bitptr start; |
|
unsigned int scalefac_compress, index, slen[4], part, n, i; |
|
@@ -644,8 +645,12 @@ unsigned int III_scalefactors_lsf(struct |
|
|
|
n = 0; |
|
for (part = 0; part < 4; ++part) { |
|
- for (i = 0; i < nsfb[part]; ++i) |
|
+ for (i = 0; i < nsfb[part]; ++i) { |
|
+ if (bits_left < slen[part]) |
|
+ return MAD_ERROR_BADSCFSI; |
|
channel->scalefac[n++] = mad_bit_read(ptr, slen[part]); |
|
+ bits_left -= slen[part]; |
|
+ } |
|
} |
|
|
|
while (n < 39) |
|
@@ -690,7 +695,10 @@ unsigned int III_scalefactors_lsf(struct |
|
max = (1 << slen[part]) - 1; |
|
|
|
for (i = 0; i < nsfb[part]; ++i) { |
|
+ if (bits_left < slen[part]) |
|
+ return MAD_ERROR_BADSCFSI; |
|
is_pos = mad_bit_read(ptr, slen[part]); |
|
+ bits_left -= slen[part]; |
|
|
|
channel->scalefac[n] = is_pos; |
|
gr1ch->scalefac[n++] = (is_pos == max); |
|
@@ -703,7 +711,8 @@ unsigned int III_scalefactors_lsf(struct |
|
} |
|
} |
|
|
|
- return mad_bit_length(&start, ptr); |
|
+ *part2_length = mad_bit_length(&start, ptr); |
|
+ return MAD_ERROR_NONE; |
|
} |
|
|
|
/* |
|
@@ -712,7 +721,8 @@ unsigned int III_scalefactors_lsf(struct |
|
*/ |
|
static |
|
unsigned int III_scalefactors(struct mad_bitptr *ptr, struct channel *channel, |
|
- struct channel const *gr0ch, unsigned int scfsi) |
|
+ struct channel const *gr0ch, unsigned int scfsi, |
|
+ unsigned int bits_left, unsigned int *part2_length) |
|
{ |
|
struct mad_bitptr start; |
|
unsigned int slen1, slen2, sfbi; |
|
@@ -728,12 +738,20 @@ unsigned int III_scalefactors(struct mad |
|
sfbi = 0; |
|
|
|
nsfb = (channel->flags & mixed_block_flag) ? 8 + 3 * 3 : 6 * 3; |
|
- while (nsfb--) |
|
+ while (nsfb--) { |
|
+ if (bits_left < slen1) |
|
+ return MAD_ERROR_BADSCFSI; |
|
channel->scalefac[sfbi++] = mad_bit_read(ptr, slen1); |
|
+ bits_left -= slen1; |
|
+ } |
|
|
|
nsfb = 6 * 3; |
|
- while (nsfb--) |
|
+ while (nsfb--) { |
|
+ if (bits_left < slen2) |
|
+ return MAD_ERROR_BADSCFSI; |
|
channel->scalefac[sfbi++] = mad_bit_read(ptr, slen2); |
|
+ bits_left -= slen2; |
|
+ } |
|
|
|
nsfb = 1 * 3; |
|
while (nsfb--) |
|
@@ -745,8 +763,12 @@ unsigned int III_scalefactors(struct mad |
|
channel->scalefac[sfbi] = gr0ch->scalefac[sfbi]; |
|
} |
|
else { |
|
- for (sfbi = 0; sfbi < 6; ++sfbi) |
|
+ for (sfbi = 0; sfbi < 6; ++sfbi) { |
|
+ if (bits_left < slen1) |
|
+ return MAD_ERROR_BADSCFSI; |
|
channel->scalefac[sfbi] = mad_bit_read(ptr, slen1); |
|
+ bits_left -= slen1; |
|
+ } |
|
} |
|
|
|
if (scfsi & 0x4) { |
|
@@ -754,8 +776,12 @@ unsigned int III_scalefactors(struct mad |
|
channel->scalefac[sfbi] = gr0ch->scalefac[sfbi]; |
|
} |
|
else { |
|
- for (sfbi = 6; sfbi < 11; ++sfbi) |
|
+ for (sfbi = 6; sfbi < 11; ++sfbi) { |
|
+ if (bits_left < slen1) |
|
+ return MAD_ERROR_BADSCFSI; |
|
channel->scalefac[sfbi] = mad_bit_read(ptr, slen1); |
|
+ bits_left -= slen1; |
|
+ } |
|
} |
|
|
|
if (scfsi & 0x2) { |
|
@@ -763,8 +789,12 @@ unsigned int III_scalefactors(struct mad |
|
channel->scalefac[sfbi] = gr0ch->scalefac[sfbi]; |
|
} |
|
else { |
|
- for (sfbi = 11; sfbi < 16; ++sfbi) |
|
+ for (sfbi = 11; sfbi < 16; ++sfbi) { |
|
+ if (bits_left < slen2) |
|
+ return MAD_ERROR_BADSCFSI; |
|
channel->scalefac[sfbi] = mad_bit_read(ptr, slen2); |
|
+ bits_left -= slen2; |
|
+ } |
|
} |
|
|
|
if (scfsi & 0x1) { |
|
@@ -772,14 +802,19 @@ unsigned int III_scalefactors(struct mad |
|
channel->scalefac[sfbi] = gr0ch->scalefac[sfbi]; |
|
} |
|
else { |
|
- for (sfbi = 16; sfbi < 21; ++sfbi) |
|
+ for (sfbi = 16; sfbi < 21; ++sfbi) { |
|
+ if (bits_left < slen2) |
|
+ return MAD_ERROR_BADSCFSI; |
|
channel->scalefac[sfbi] = mad_bit_read(ptr, slen2); |
|
+ bits_left -= slen2; |
|
+ } |
|
} |
|
|
|
channel->scalefac[21] = 0; |
|
} |
|
|
|
- return mad_bit_length(&start, ptr); |
|
+ *part2_length = mad_bit_length(&start, ptr); |
|
+ return MAD_ERROR_NONE; |
|
} |
|
|
|
/* |
|
@@ -933,19 +968,17 @@ static |
|
enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576], |
|
struct channel *channel, |
|
unsigned char const *sfbwidth, |
|
- unsigned int part2_length) |
|
+ signed int part3_length) |
|
{ |
|
signed int exponents[39], exp; |
|
signed int const *expptr; |
|
struct mad_bitptr peek; |
|
- signed int bits_left, cachesz; |
|
+ signed int bits_left, cachesz, fakebits; |
|
register mad_fixed_t *xrptr; |
|
mad_fixed_t const *sfbound; |
|
register unsigned long bitcache; |
|
|
|
- bits_left = (signed) channel->part2_3_length - (signed) part2_length; |
|
- if (bits_left < 0) |
|
- return MAD_ERROR_BADPART3LEN; |
|
+ bits_left = part3_length; |
|
|
|
III_exponents(channel, sfbwidth, exponents); |
|
|
|
@@ -956,8 +989,12 @@ enum mad_error III_huffdecode(struct mad |
|
cachesz = mad_bit_bitsleft(&peek); |
|
cachesz += ((32 - 1 - 24) + (24 - cachesz)) & ~7; |
|
|
|
+ if (bits_left < cachesz) { |
|
+ cachesz = bits_left; |
|
+ } |
|
bitcache = mad_bit_read(&peek, cachesz); |
|
bits_left -= cachesz; |
|
+ fakebits = 0; |
|
|
|
xrptr = &xr[0]; |
|
|
|
@@ -986,7 +1023,7 @@ enum mad_error III_huffdecode(struct mad |
|
|
|
big_values = channel->big_values; |
|
|
|
- while (big_values-- && cachesz + bits_left > 0) { |
|
+ while (big_values-- && cachesz + bits_left - fakebits > 0) { |
|
union huffpair const *pair; |
|
unsigned int clumpsz, value; |
|
register mad_fixed_t requantized; |
|
@@ -1023,10 +1060,19 @@ enum mad_error III_huffdecode(struct mad |
|
unsigned int bits; |
|
|
|
bits = ((32 - 1 - 21) + (21 - cachesz)) & ~7; |
|
+ if (bits_left < bits) { |
|
+ bits = bits_left; |
|
+ } |
|
bitcache = (bitcache << bits) | mad_bit_read(&peek, bits); |
|
cachesz += bits; |
|
bits_left -= bits; |
|
} |
|
+ if (cachesz < 21) { |
|
+ unsigned int bits = 21 - cachesz; |
|
+ bitcache <<= bits; |
|
+ cachesz += bits; |
|
+ fakebits += bits; |
|
+ } |
|
|
|
/* hcod (0..19) */ |
|
|
|
@@ -1041,6 +1087,8 @@ enum mad_error III_huffdecode(struct mad |
|
} |
|
|
|
cachesz -= pair->value.hlen; |
|
+ if (cachesz < fakebits) |
|
+ return MAD_ERROR_BADHUFFDATA; |
|
|
|
if (linbits) { |
|
/* x (0..14) */ |
|
@@ -1054,10 +1102,15 @@ enum mad_error III_huffdecode(struct mad |
|
|
|
case 15: |
|
if (cachesz < linbits + 2) { |
|
- bitcache = (bitcache << 16) | mad_bit_read(&peek, 16); |
|
- cachesz += 16; |
|
- bits_left -= 16; |
|
+ unsigned int bits = 16; |
|
+ if (bits_left < 16) |
|
+ bits = bits_left; |
|
+ bitcache = (bitcache << bits) | mad_bit_read(&peek, bits); |
|
+ cachesz += bits; |
|
+ bits_left -= bits; |
|
} |
|
+ if (cachesz - fakebits < linbits) |
|
+ return MAD_ERROR_BADHUFFDATA; |
|
|
|
value += MASK(bitcache, cachesz, linbits); |
|
cachesz -= linbits; |
|
@@ -1074,6 +1127,8 @@ enum mad_error III_huffdecode(struct mad |
|
} |
|
|
|
x_final: |
|
+ if (cachesz - fakebits < 1) |
|
+ return MAD_ERROR_BADHUFFDATA; |
|
xrptr[0] = MASK1BIT(bitcache, cachesz--) ? |
|
-requantized : requantized; |
|
} |
|
@@ -1089,10 +1144,15 @@ enum mad_error III_huffdecode(struct mad |
|
|
|
case 15: |
|
if (cachesz < linbits + 1) { |
|
- bitcache = (bitcache << 16) | mad_bit_read(&peek, 16); |
|
- cachesz += 16; |
|
- bits_left -= 16; |
|
+ unsigned int bits = 16; |
|
+ if (bits_left < 16) |
|
+ bits = bits_left; |
|
+ bitcache = (bitcache << bits) | mad_bit_read(&peek, bits); |
|
+ cachesz += bits; |
|
+ bits_left -= bits; |
|
} |
|
+ if (cachesz - fakebits < linbits) |
|
+ return MAD_ERROR_BADHUFFDATA; |
|
|
|
value += MASK(bitcache, cachesz, linbits); |
|
cachesz -= linbits; |
|
@@ -1109,6 +1169,8 @@ enum mad_error III_huffdecode(struct mad |
|
} |
|
|
|
y_final: |
|
+ if (cachesz - fakebits < 1) |
|
+ return MAD_ERROR_BADHUFFDATA; |
|
xrptr[1] = MASK1BIT(bitcache, cachesz--) ? |
|
-requantized : requantized; |
|
} |
|
@@ -1128,6 +1190,8 @@ enum mad_error III_huffdecode(struct mad |
|
requantized = reqcache[value] = III_requantize(value, exp); |
|
} |
|
|
|
+ if (cachesz - fakebits < 1) |
|
+ return MAD_ERROR_BADHUFFDATA; |
|
xrptr[0] = MASK1BIT(bitcache, cachesz--) ? |
|
-requantized : requantized; |
|
} |
|
@@ -1146,6 +1210,8 @@ enum mad_error III_huffdecode(struct mad |
|
requantized = reqcache[value] = III_requantize(value, exp); |
|
} |
|
|
|
+ if (cachesz - fakebits < 1) |
|
+ return MAD_ERROR_BADHUFFDATA; |
|
xrptr[1] = MASK1BIT(bitcache, cachesz--) ? |
|
-requantized : requantized; |
|
} |
|
@@ -1155,9 +1221,6 @@ enum mad_error III_huffdecode(struct mad |
|
} |
|
} |
|
|
|
- if (cachesz + bits_left < 0) |
|
- return MAD_ERROR_BADHUFFDATA; /* big_values overrun */ |
|
- |
|
/* count1 */ |
|
{ |
|
union huffquad const *table; |
|
@@ -1167,15 +1230,24 @@ enum mad_error III_huffdecode(struct mad |
|
|
|
requantized = III_requantize(1, exp); |
|
|
|
- while (cachesz + bits_left > 0 && xrptr <= &xr[572]) { |
|
+ while (cachesz + bits_left - fakebits > 0 && xrptr <= &xr[572]) { |
|
union huffquad const *quad; |
|
|
|
/* hcod (1..6) */ |
|
|
|
if (cachesz < 10) { |
|
- bitcache = (bitcache << 16) | mad_bit_read(&peek, 16); |
|
- cachesz += 16; |
|
- bits_left -= 16; |
|
+ unsigned int bits = 16; |
|
+ if (bits_left < 16) |
|
+ bits = bits_left; |
|
+ bitcache = (bitcache << bits) | mad_bit_read(&peek, bits); |
|
+ cachesz += bits; |
|
+ bits_left -= bits; |
|
+ } |
|
+ if (cachesz < 10) { |
|
+ unsigned int bits = 10 - cachesz; |
|
+ bitcache <<= bits; |
|
+ cachesz += bits; |
|
+ fakebits += bits; |
|
} |
|
|
|
quad = &table[MASK(bitcache, cachesz, 4)]; |
|
@@ -1188,6 +1260,11 @@ enum mad_error III_huffdecode(struct mad |
|
MASK(bitcache, cachesz, quad->ptr.bits)]; |
|
} |
|
|
|
+ if (cachesz - fakebits < quad->value.hlen + quad->value.v |
|
+ + quad->value.w + quad->value.x + quad->value.y) |
|
+ /* We don't have enough bits to read one more entry, consider them |
|
+ * stuffing bits. */ |
|
+ break; |
|
cachesz -= quad->value.hlen; |
|
|
|
if (xrptr == sfbound) { |
|
@@ -1236,22 +1313,8 @@ enum mad_error III_huffdecode(struct mad |
|
|
|
xrptr += 2; |
|
} |
|
- |
|
- if (cachesz + bits_left < 0) { |
|
-# if 0 && defined(DEBUG) |
|
- fprintf(stderr, "huffman count1 overrun (%d bits)\n", |
|
- -(cachesz + bits_left)); |
|
-# endif |
|
- |
|
- /* technically the bitstream is misformatted, but apparently |
|
- some encoders are just a bit sloppy with stuffing bits */ |
|
- |
|
- xrptr -= 4; |
|
- } |
|
} |
|
|
|
- assert(-bits_left <= MAD_BUFFER_GUARD * CHAR_BIT); |
|
- |
|
# if 0 && defined(DEBUG) |
|
if (bits_left < 0) |
|
fprintf(stderr, "read %d bits too many\n", -bits_left); |
|
@@ -2348,10 +2411,11 @@ void III_freqinver(mad_fixed_t sample[18 |
|
*/ |
|
static |
|
enum mad_error III_decode(struct mad_bitptr *ptr, struct mad_frame *frame, |
|
- struct sideinfo *si, unsigned int nch) |
|
+ struct sideinfo *si, unsigned int nch, unsigned int md_len) |
|
{ |
|
struct mad_header *header = &frame->header; |
|
unsigned int sfreqi, ngr, gr; |
|
+ int bits_left = md_len * CHAR_BIT; |
|
|
|
{ |
|
unsigned int sfreq; |
|
@@ -2383,6 +2447,7 @@ enum mad_error III_decode(struct mad_bit |
|
for (ch = 0; ch < nch; ++ch) { |
|
struct channel *channel = &granule->ch[ch]; |
|
unsigned int part2_length; |
|
+ unsigned int part3_length; |
|
|
|
sfbwidth[ch] = sfbwidth_table[sfreqi].l; |
|
if (channel->block_type == 2) { |
|
@@ -2391,18 +2456,30 @@ enum mad_error III_decode(struct mad_bit |
|
} |
|
|
|
if (header->flags & MAD_FLAG_LSF_EXT) { |
|
- part2_length = III_scalefactors_lsf(ptr, channel, |
|
+ error = III_scalefactors_lsf(ptr, channel, |
|
ch == 0 ? 0 : &si->gr[1].ch[1], |
|
- header->mode_extension); |
|
+ header->mode_extension, bits_left, &part2_length); |
|
} |
|
else { |
|
- part2_length = III_scalefactors(ptr, channel, &si->gr[0].ch[ch], |
|
- gr == 0 ? 0 : si->scfsi[ch]); |
|
+ error = III_scalefactors(ptr, channel, &si->gr[0].ch[ch], |
|
+ gr == 0 ? 0 : si->scfsi[ch], bits_left, &part2_length); |
|
} |
|
+ if (error) |
|
+ return error; |
|
+ |
|
+ bits_left -= part2_length; |
|
|
|
- error = III_huffdecode(ptr, xr[ch], channel, sfbwidth[ch], part2_length); |
|
+ if (part2_length > channel->part2_3_length) |
|
+ return MAD_ERROR_BADPART3LEN; |
|
+ |
|
+ part3_length = channel->part2_3_length - part2_length; |
|
+ if (part3_length > bits_left) |
|
+ return MAD_ERROR_BADPART3LEN; |
|
+ |
|
+ error = III_huffdecode(ptr, xr[ch], channel, sfbwidth[ch], part3_length); |
|
if (error) |
|
return error; |
|
+ bits_left -= part3_length; |
|
} |
|
|
|
/* joint stereo processing */ |
|
@@ -2519,11 +2596,13 @@ int mad_layer_III(struct mad_stream *str |
|
unsigned int nch, priv_bitlen, next_md_begin = 0; |
|
unsigned int si_len, data_bitlen, md_len; |
|
unsigned int frame_space, frame_used, frame_free; |
|
- struct mad_bitptr ptr; |
|
+ struct mad_bitptr ptr, bufend_ptr; |
|
struct sideinfo si; |
|
enum mad_error error; |
|
int result = 0; |
|
|
|
+ mad_bit_init(&bufend_ptr, stream->bufend); |
|
+ |
|
/* allocate Layer III dynamic structures */ |
|
|
|
if (stream->main_data == 0) { |
|
@@ -2587,14 +2666,15 @@ int mad_layer_III(struct mad_stream *str |
|
unsigned long header; |
|
|
|
mad_bit_init(&peek, stream->next_frame); |
|
+ if (mad_bit_length(&peek, &bufend_ptr) >= 57) { |
|
+ header = mad_bit_read(&peek, 32); |
|
+ if ((header & 0xffe60000L) /* syncword | layer */ == 0xffe20000L) { |
|
+ if (!(header & 0x00010000L)) /* protection_bit */ |
|
+ mad_bit_skip(&peek, 16); /* crc_check */ |
|
|
|
- header = mad_bit_read(&peek, 32); |
|
- if ((header & 0xffe60000L) /* syncword | layer */ == 0xffe20000L) { |
|
- if (!(header & 0x00010000L)) /* protection_bit */ |
|
- mad_bit_skip(&peek, 16); /* crc_check */ |
|
- |
|
- next_md_begin = |
|
- mad_bit_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8); |
|
+ next_md_begin = |
|
+ mad_bit_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8); |
|
+ } |
|
} |
|
|
|
mad_bit_finish(&peek); |
|
@@ -2653,7 +2733,7 @@ int mad_layer_III(struct mad_stream *str |
|
/* decode main_data */ |
|
|
|
if (result == 0) { |
|
- error = III_decode(&ptr, frame, &si, nch); |
|
+ error = III_decode(&ptr, frame, &si, nch, md_len); |
|
if (error) { |
|
stream->error = error; |
|
result = -1;
|
|
|