diff options
author | Tim Terriberry <tterribe@xiph.org> | 2010-10-14 01:05:50 +0000 |
---|---|---|
committer | Tim Terriberry <tterribe@xiph.org> | 2010-10-14 01:05:50 +0000 |
commit | 28854b5669212379c190640063be53b19f12ab88 (patch) | |
tree | 01f5b70ac3c76888b59b10c8f446fbc576845166 | |
parent | ba51e86cb277cea805ddc2506b63d01ddd919763 (diff) | |
download | tremor-28854b5669212379c190640063be53b19f12ab88.tar.gz |
Port the rest of r16222 from libvorbis.
Commit additional hardening to setup packet decode.
git-svn-id: https://svn.xiph.org/trunk/Tremor@17525 0101bb08-14d6-0310-b084-bc0e0c8e3800
-rw-r--r-- | codebook.c | 1 | ||||
-rw-r--r-- | floor1.c | 2 | ||||
-rw-r--r-- | info.c | 17 | ||||
-rw-r--r-- | mapping0.c | 24 |
4 files changed, 25 insertions, 19 deletions
@@ -100,6 +100,7 @@ int vorbis_staticbook_unpack(oggpack_buffer *opb,static_codebook *s){ s->q_delta=oggpack_read(opb,32); s->q_quant=oggpack_read(opb,4)+1; s->q_sequencep=oggpack_read(opb,1); + if(s->q_sequencep==-1)goto _eofout; { int quantvals=0; @@ -81,6 +81,7 @@ static vorbis_info_floor *floor1_unpack (vorbis_info *vi,oggpack_buffer *opb){ info->partitions=oggpack_read(opb,5); /* only 0 to 31 legal */ for(j=0;j<info->partitions;j++){ info->partitionclass[j]=oggpack_read(opb,4); /* only 0 to 15 legal */ + if(info->partitionclass[j]<0)goto err_out; if(maxclass<info->partitionclass[j])maxclass=info->partitionclass[j]; } @@ -103,6 +104,7 @@ static vorbis_info_floor *floor1_unpack (vorbis_info *vi,oggpack_buffer *opb){ /* read the post list */ info->mult=oggpack_read(opb,2)+1; /* only 1,2,3,4 legal now */ rangebits=oggpack_read(opb,4); + if(rangebits<0)goto err_out; for(j=0,k=0;j<info->partitions;j++){ count+=info->class_dim[info->partitionclass[j]]; @@ -231,7 +231,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* codebooks */ ci->books=oggpack_read(opb,8)+1; - /*ci->book_param=_ogg_calloc(ci->books,sizeof(*ci->book_param));*/ + if(ci->books<=0)goto err_out; for(i=0;i<ci->books;i++){ ci->book_param[i]=(static_codebook *)_ogg_calloc(1,sizeof(*ci->book_param[i])); if(vorbis_staticbook_unpack(opb,ci->book_param[i]))goto err_out; @@ -239,8 +239,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* time backend settings */ ci->times=oggpack_read(opb,6)+1; - /*ci->time_type=_ogg_malloc(ci->times*sizeof(*ci->time_type));*/ - /*ci->time_param=_ogg_calloc(ci->times,sizeof(void *));*/ + if(ci->times<=0)goto err_out; for(i=0;i<ci->times;i++){ ci->time_type[i]=oggpack_read(opb,16); if(ci->time_type[i]<0 || ci->time_type[i]>=VI_TIMEB)goto err_out; @@ -251,8 +250,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* floor backend settings */ ci->floors=oggpack_read(opb,6)+1; - /*ci->floor_type=_ogg_malloc(ci->floors*sizeof(*ci->floor_type));*/ - /*ci->floor_param=_ogg_calloc(ci->floors,sizeof(void *));*/ + if(ci->floors<=0)goto err_out; for(i=0;i<ci->floors;i++){ ci->floor_type[i]=oggpack_read(opb,16); if(ci->floor_type[i]<0 || ci->floor_type[i]>=VI_FLOORB)goto err_out; @@ -262,8 +260,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* residue backend settings */ ci->residues=oggpack_read(opb,6)+1; - /*ci->residue_type=_ogg_malloc(ci->residues*sizeof(*ci->residue_type));*/ - /*ci->residue_param=_ogg_calloc(ci->residues,sizeof(void *));*/ + if(ci->residues<=0)goto err_out; for(i=0;i<ci->residues;i++){ ci->residue_type[i]=oggpack_read(opb,16); if(ci->residue_type[i]<0 || ci->residue_type[i]>=VI_RESB)goto err_out; @@ -273,8 +270,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* map backend settings */ ci->maps=oggpack_read(opb,6)+1; - /*ci->map_type=_ogg_malloc(ci->maps*sizeof(*ci->map_type));*/ - /*ci->map_param=_ogg_calloc(ci->maps,sizeof(void *));*/ + if(ci->maps<=0)goto err_out; for(i=0;i<ci->maps;i++){ ci->map_type[i]=oggpack_read(opb,16); if(ci->map_type[i]<0 || ci->map_type[i]>=VI_MAPB)goto err_out; @@ -284,7 +280,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ /* mode settings */ ci->modes=oggpack_read(opb,6)+1; - /*vi->mode_param=_ogg_calloc(vi->modes,sizeof(void *));*/ + if(ci->modes<=0)goto err_out; for(i=0;i<ci->modes;i++){ ci->mode_param[i]=(vorbis_info_mode *)_ogg_calloc(1,sizeof(*ci->mode_param[i])); ci->mode_param[i]->blockflag=oggpack_read(opb,1); @@ -295,6 +291,7 @@ static int _vorbis_unpack_books(vorbis_info *vi,oggpack_buffer *opb){ if(ci->mode_param[i]->windowtype>=VI_WINDOWB)goto err_out; if(ci->mode_param[i]->transformtype>=VI_WINDOWB)goto err_out; if(ci->mode_param[i]->mapping>=ci->maps)goto err_out; + if(ci->mode_param[i]->mapping<0)goto err_out; } if(oggpack_read(opb,1)!=1)goto err_out; /* top level EOP check */ @@ -126,19 +126,24 @@ static int ilog(unsigned int v){ /* also responsible for range checking */ static vorbis_info_mapping *mapping0_unpack(vorbis_info *vi,oggpack_buffer *opb){ - int i; + int i,b; vorbis_info_mapping0 *info=(vorbis_info_mapping0 *)_ogg_calloc(1,sizeof(*info)); codec_setup_info *ci=(codec_setup_info *)vi->codec_setup; memset(info,0,sizeof(*info)); - if(oggpack_read(opb,1)) + b=oggpack_read(opb,1); + if(b<0)goto err_out; + if(b){ info->submaps=oggpack_read(opb,4)+1; - else + if(info->submaps<=0)goto err_out; + }else info->submaps=1; - if(oggpack_read(opb,1)){ + b=oggpack_read(opb,1); + if(b<0)goto err_out; + if(b){ info->coupling_steps=oggpack_read(opb,8)+1; - + if(info->coupling_steps<=0)goto err_out; for(i=0;i<info->coupling_steps;i++){ int testM=info->coupling_mag[i]=oggpack_read(opb,ilog(vi->channels)); int testA=info->coupling_ang[i]=oggpack_read(opb,ilog(vi->channels)); @@ -152,21 +157,22 @@ static vorbis_info_mapping *mapping0_unpack(vorbis_info *vi,oggpack_buffer *opb) } - if(oggpack_read(opb,2)>0)goto err_out; /* 2,3:reserved */ + if(oggpack_read(opb,2)!=0)goto err_out; /* 2,3:reserved */ if(info->submaps>1){ for(i=0;i<vi->channels;i++){ info->chmuxlist[i]=oggpack_read(opb,4); - if(info->chmuxlist[i]>=info->submaps)goto err_out; + if(info->chmuxlist[i]>=info->submaps || info->chmuxlist[i]<0)goto err_out; } } for(i=0;i<info->submaps;i++){ int temp=oggpack_read(opb,8); if(temp>=ci->times)goto err_out; info->floorsubmap[i]=oggpack_read(opb,8); - if(info->floorsubmap[i]>=ci->floors)goto err_out; + if(info->floorsubmap[i]>=ci->floors || info->floorsubmap[i]<0)goto err_out; info->residuesubmap[i]=oggpack_read(opb,8); - if(info->residuesubmap[i]>=ci->residues)goto err_out; + if(info->residuesubmap[i]>=ci->residues || info->residuesubmap[i]<0) + goto err_out; } return info; |