| From: Kurt Roeckx <kurt@roeckx.be> |
| Date: Sun, 28 Jan 2018 19:26:36 +0100 |
| Subject: Check the size before reading with mad_bit_read |
| |
| There are various cases where it attemps to read past the end of the buffer |
| using mad_bit_read(). Most functions didn't even know the size of the buffer |
| they were reading from. |
| |
| Index: libmad-0.15.1b/bit.c |
| =================================================================== |
| --- libmad-0.15.1b.orig/bit.c |
| +++ libmad-0.15.1b/bit.c |
| @@ -138,6 +138,9 @@ unsigned long mad_bit_read(struct mad_bi |
| { |
| register unsigned long value; |
| |
| + if (len == 0) |
| + return 0; |
| + |
| if (bitptr->left == CHAR_BIT) |
| bitptr->cache = *bitptr->byte; |
| |
| Index: libmad-0.15.1b/frame.c |
| =================================================================== |
| --- libmad-0.15.1b.orig/frame.c |
| +++ libmad-0.15.1b/frame.c |
| @@ -120,11 +120,18 @@ static |
| int decode_header(struct mad_header *header, struct mad_stream *stream) |
| { |
| unsigned int index; |
| + struct mad_bitptr bufend_ptr; |
| |
| header->flags = 0; |
| header->private_bits = 0; |
| |
| + mad_bit_init(&bufend_ptr, stream->bufend); |
| + |
| /* header() */ |
| + if (mad_bit_length(&stream->ptr, &bufend_ptr) < 32) { |
| + stream->error = MAD_ERROR_BUFLEN; |
| + return -1; |
| + } |
| |
| /* syncword */ |
| mad_bit_skip(&stream->ptr, 11); |
| @@ -225,8 +232,13 @@ int decode_header(struct mad_header *hea |
| /* error_check() */ |
| |
| /* crc_check */ |
| - if (header->flags & MAD_FLAG_PROTECTION) |
| + if (header->flags & MAD_FLAG_PROTECTION) { |
| + if (mad_bit_length(&stream->ptr, &bufend_ptr) < 16) { |
| + stream->error = MAD_ERROR_BUFLEN; |
| + return -1; |
| + } |
| header->crc_target = mad_bit_read(&stream->ptr, 16); |
| + } |
| |
| return 0; |
| } |
| @@ -338,7 +350,7 @@ int mad_header_decode(struct mad_header |
| stream->error = MAD_ERROR_BUFLEN; |
| goto fail; |
| } |
| - else if (!(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) { |
| + else if ((end - ptr >= 2) && !(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) { |
| /* mark point where frame sync word was expected */ |
| stream->this_frame = ptr; |
| stream->next_frame = ptr + 1; |
| @@ -361,6 +373,8 @@ int mad_header_decode(struct mad_header |
| ptr = mad_bit_nextbyte(&stream->ptr); |
| } |
| |
| + stream->error = MAD_ERROR_NONE; |
| + |
| /* begin processing */ |
| stream->this_frame = ptr; |
| stream->next_frame = ptr + 1; /* possibly bogus sync word */ |
| @@ -413,7 +427,7 @@ int mad_header_decode(struct mad_header |
| /* check that a valid frame header follows this frame */ |
| |
| ptr = stream->next_frame; |
| - if (!(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) { |
| + if ((end - ptr >= 2) && !(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) { |
| ptr = stream->next_frame = stream->this_frame + 1; |
| goto sync; |
| } |
| Index: libmad-0.15.1b/layer12.c |
| =================================================================== |
| --- libmad-0.15.1b.orig/layer12.c |
| +++ libmad-0.15.1b/layer12.c |
| @@ -72,10 +72,18 @@ mad_fixed_t const linear_table[14] = { |
| * DESCRIPTION: decode one requantized Layer I sample from a bitstream |
| */ |
| static |
| -mad_fixed_t I_sample(struct mad_bitptr *ptr, unsigned int nb) |
| +mad_fixed_t I_sample(struct mad_bitptr *ptr, unsigned int nb, struct mad_stream *stream) |
| { |
| mad_fixed_t sample; |
| + struct mad_bitptr frameend_ptr; |
| |
| + mad_bit_init(&frameend_ptr, stream->next_frame); |
| + |
| + if (mad_bit_length(ptr, &frameend_ptr) < nb) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return 0; |
| + } |
| sample = mad_bit_read(ptr, nb); |
| |
| /* invert most significant bit, extend sign, then scale to fixed format */ |
| @@ -106,6 +114,10 @@ int mad_layer_I(struct mad_stream *strea |
| struct mad_header *header = &frame->header; |
| unsigned int nch, bound, ch, s, sb, nb; |
| unsigned char allocation[2][32], scalefactor[2][32]; |
| + struct mad_bitptr bufend_ptr, frameend_ptr; |
| + |
| + mad_bit_init(&bufend_ptr, stream->bufend); |
| + mad_bit_init(&frameend_ptr, stream->next_frame); |
| |
| nch = MAD_NCHANNELS(header); |
| |
| @@ -118,6 +130,11 @@ int mad_layer_I(struct mad_stream *strea |
| /* check CRC word */ |
| |
| if (header->flags & MAD_FLAG_PROTECTION) { |
| + if (mad_bit_length(&stream->ptr, &bufend_ptr) |
| + < 4 * (bound * nch + (32 - bound))) { |
| + stream->error = MAD_ERROR_BADCRC; |
| + return -1; |
| + } |
| header->crc_check = |
| mad_bit_crc(stream->ptr, 4 * (bound * nch + (32 - bound)), |
| header->crc_check); |
| @@ -133,6 +150,11 @@ int mad_layer_I(struct mad_stream *strea |
| |
| for (sb = 0; sb < bound; ++sb) { |
| for (ch = 0; ch < nch; ++ch) { |
| + if (mad_bit_length(&stream->ptr, &frameend_ptr) < 4) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return -1; |
| + } |
| nb = mad_bit_read(&stream->ptr, 4); |
| |
| if (nb == 15) { |
| @@ -145,6 +167,11 @@ int mad_layer_I(struct mad_stream *strea |
| } |
| |
| for (sb = bound; sb < 32; ++sb) { |
| + if (mad_bit_length(&stream->ptr, &frameend_ptr) < 4) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return -1; |
| + } |
| nb = mad_bit_read(&stream->ptr, 4); |
| |
| if (nb == 15) { |
| @@ -161,6 +188,11 @@ int mad_layer_I(struct mad_stream *strea |
| for (sb = 0; sb < 32; ++sb) { |
| for (ch = 0; ch < nch; ++ch) { |
| if (allocation[ch][sb]) { |
| + if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return -1; |
| + } |
| scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6); |
| |
| # if defined(OPT_STRICT) |
| @@ -185,8 +217,10 @@ int mad_layer_I(struct mad_stream *strea |
| for (ch = 0; ch < nch; ++ch) { |
| nb = allocation[ch][sb]; |
| frame->sbsample[ch][s][sb] = nb ? |
| - mad_f_mul(I_sample(&stream->ptr, nb), |
| + mad_f_mul(I_sample(&stream->ptr, nb, stream), |
| sf_table[scalefactor[ch][sb]]) : 0; |
| + if (stream->error != 0) |
| + return -1; |
| } |
| } |
| |
| @@ -194,7 +228,14 @@ int mad_layer_I(struct mad_stream *strea |
| if ((nb = allocation[0][sb])) { |
| mad_fixed_t sample; |
| |
| - sample = I_sample(&stream->ptr, nb); |
| + if (mad_bit_length(&stream->ptr, &frameend_ptr) < nb) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return -1; |
| + } |
| + sample = I_sample(&stream->ptr, nb, stream); |
| + if (stream->error != 0) |
| + return -1; |
| |
| for (ch = 0; ch < nch; ++ch) { |
| frame->sbsample[ch][s][sb] = |
| @@ -280,13 +321,21 @@ struct quantclass { |
| static |
| void II_samples(struct mad_bitptr *ptr, |
| struct quantclass const *quantclass, |
| - mad_fixed_t output[3]) |
| + mad_fixed_t output[3], struct mad_stream *stream) |
| { |
| unsigned int nb, s, sample[3]; |
| + struct mad_bitptr frameend_ptr; |
| + |
| + mad_bit_init(&frameend_ptr, stream->next_frame); |
| |
| if ((nb = quantclass->group)) { |
| unsigned int c, nlevels; |
| |
| + if (mad_bit_length(ptr, &frameend_ptr) < quantclass->bits) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return; |
| + } |
| /* degrouping */ |
| c = mad_bit_read(ptr, quantclass->bits); |
| nlevels = quantclass->nlevels; |
| @@ -299,8 +348,14 @@ void II_samples(struct mad_bitptr *ptr, |
| else { |
| nb = quantclass->bits; |
| |
| - for (s = 0; s < 3; ++s) |
| + for (s = 0; s < 3; ++s) { |
| + if (mad_bit_length(ptr, &frameend_ptr) < nb) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return; |
| + } |
| sample[s] = mad_bit_read(ptr, nb); |
| + } |
| } |
| |
| for (s = 0; s < 3; ++s) { |
| @@ -336,6 +391,9 @@ int mad_layer_II(struct mad_stream *stre |
| unsigned char const *offsets; |
| unsigned char allocation[2][32], scfsi[2][32], scalefactor[2][32][3]; |
| mad_fixed_t samples[3]; |
| + struct mad_bitptr frameend_ptr; |
| + |
| + mad_bit_init(&frameend_ptr, stream->next_frame); |
| |
| nch = MAD_NCHANNELS(header); |
| |
| @@ -402,13 +460,24 @@ int mad_layer_II(struct mad_stream *stre |
| for (sb = 0; sb < bound; ++sb) { |
| nbal = bitalloc_table[offsets[sb]].nbal; |
| |
| - for (ch = 0; ch < nch; ++ch) |
| + for (ch = 0; ch < nch; ++ch) { |
| + if (mad_bit_length(&stream->ptr, &frameend_ptr) < nbal) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return -1; |
| + } |
| allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal); |
| + } |
| } |
| |
| for (sb = bound; sb < sblimit; ++sb) { |
| nbal = bitalloc_table[offsets[sb]].nbal; |
| |
| + if (mad_bit_length(&stream->ptr, &frameend_ptr) < nbal) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return -1; |
| + } |
| allocation[0][sb] = |
| allocation[1][sb] = mad_bit_read(&stream->ptr, nbal); |
| } |
| @@ -417,8 +486,14 @@ int mad_layer_II(struct mad_stream *stre |
| |
| for (sb = 0; sb < sblimit; ++sb) { |
| for (ch = 0; ch < nch; ++ch) { |
| - if (allocation[ch][sb]) |
| + if (allocation[ch][sb]) { |
| + if (mad_bit_length(&stream->ptr, &frameend_ptr) < 2) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return -1; |
| + } |
| scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2); |
| + } |
| } |
| } |
| |
| @@ -441,6 +516,11 @@ int mad_layer_II(struct mad_stream *stre |
| for (sb = 0; sb < sblimit; ++sb) { |
| for (ch = 0; ch < nch; ++ch) { |
| if (allocation[ch][sb]) { |
| + if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return -1; |
| + } |
| scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6); |
| |
| switch (scfsi[ch][sb]) { |
| @@ -451,11 +531,21 @@ int mad_layer_II(struct mad_stream *stre |
| break; |
| |
| case 0: |
| + if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return -1; |
| + } |
| scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6); |
| /* fall through */ |
| |
| case 1: |
| case 3: |
| + if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) { |
| + stream->error = MAD_ERROR_LOSTSYNC; |
| + stream->sync = 0; |
| + return -1; |
| + } |
| scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6); |
| } |
| |
| @@ -487,7 +577,9 @@ int mad_layer_II(struct mad_stream *stre |
| if ((index = allocation[ch][sb])) { |
| index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1]; |
| |
| - II_samples(&stream->ptr, &qc_table[index], samples); |
| + II_samples(&stream->ptr, &qc_table[index], samples, stream); |
| + if (stream->error != 0) |
| + return -1; |
| |
| for (s = 0; s < 3; ++s) { |
| frame->sbsample[ch][3 * gr + s][sb] = |
| @@ -505,7 +597,9 @@ int mad_layer_II(struct mad_stream *stre |
| if ((index = allocation[0][sb])) { |
| index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1]; |
| |
| - II_samples(&stream->ptr, &qc_table[index], samples); |
| + II_samples(&stream->ptr, &qc_table[index], samples, stream); |
| + if (stream->error != 0) |
| + return -1; |
| |
| for (ch = 0; ch < nch; ++ch) { |
| for (s = 0; s < 3; ++s) { |
| Index: libmad-0.15.1b/layer3.c |
| =================================================================== |
| --- libmad-0.15.1b.orig/layer3.c |
| +++ libmad-0.15.1b/layer3.c |
| @@ -598,7 +598,8 @@ enum mad_error III_sideinfo(struct mad_b |
| static |
| unsigned int III_scalefactors_lsf(struct mad_bitptr *ptr, |
| struct channel *channel, |
| - struct channel *gr1ch, int mode_extension) |
| + struct channel *gr1ch, int mode_extension, |
| + unsigned int bits_left, unsigned int *part2_length) |
| { |
| struct mad_bitptr start; |
| unsigned int scalefac_compress, index, slen[4], part, n, i; |
| @@ -644,8 +645,12 @@ unsigned int III_scalefactors_lsf(struct |
| |
| n = 0; |
| for (part = 0; part < 4; ++part) { |
| - for (i = 0; i < nsfb[part]; ++i) |
| + for (i = 0; i < nsfb[part]; ++i) { |
| + if (bits_left < slen[part]) |
| + return MAD_ERROR_BADSCFSI; |
| channel->scalefac[n++] = mad_bit_read(ptr, slen[part]); |
| + bits_left -= slen[part]; |
| + } |
| } |
| |
| while (n < 39) |
| @@ -690,7 +695,10 @@ unsigned int III_scalefactors_lsf(struct |
| max = (1 << slen[part]) - 1; |
| |
| for (i = 0; i < nsfb[part]; ++i) { |
| + if (bits_left < slen[part]) |
| + return MAD_ERROR_BADSCFSI; |
| is_pos = mad_bit_read(ptr, slen[part]); |
| + bits_left -= slen[part]; |
| |
| channel->scalefac[n] = is_pos; |
| gr1ch->scalefac[n++] = (is_pos == max); |
| @@ -703,7 +711,8 @@ unsigned int III_scalefactors_lsf(struct |
| } |
| } |
| |
| - return mad_bit_length(&start, ptr); |
| + *part2_length = mad_bit_length(&start, ptr); |
| + return MAD_ERROR_NONE; |
| } |
| |
| /* |
| @@ -712,7 +721,8 @@ unsigned int III_scalefactors_lsf(struct |
| */ |
| static |
| unsigned int III_scalefactors(struct mad_bitptr *ptr, struct channel *channel, |
| - struct channel const *gr0ch, unsigned int scfsi) |
| + struct channel const *gr0ch, unsigned int scfsi, |
| + unsigned int bits_left, unsigned int *part2_length) |
| { |
| struct mad_bitptr start; |
| unsigned int slen1, slen2, sfbi; |
| @@ -728,12 +738,20 @@ unsigned int III_scalefactors(struct mad |
| sfbi = 0; |
| |
| nsfb = (channel->flags & mixed_block_flag) ? 8 + 3 * 3 : 6 * 3; |
| - while (nsfb--) |
| + while (nsfb--) { |
| + if (bits_left < slen1) |
| + return MAD_ERROR_BADSCFSI; |
| channel->scalefac[sfbi++] = mad_bit_read(ptr, slen1); |
| + bits_left -= slen1; |
| + } |
| |
| nsfb = 6 * 3; |
| - while (nsfb--) |
| + while (nsfb--) { |
| + if (bits_left < slen2) |
| + return MAD_ERROR_BADSCFSI; |
| channel->scalefac[sfbi++] = mad_bit_read(ptr, slen2); |
| + bits_left -= slen2; |
| + } |
| |
| nsfb = 1 * 3; |
| while (nsfb--) |
| @@ -745,8 +763,12 @@ unsigned int III_scalefactors(struct mad |
| channel->scalefac[sfbi] = gr0ch->scalefac[sfbi]; |
| } |
| else { |
| - for (sfbi = 0; sfbi < 6; ++sfbi) |
| + for (sfbi = 0; sfbi < 6; ++sfbi) { |
| + if (bits_left < slen1) |
| + return MAD_ERROR_BADSCFSI; |
| channel->scalefac[sfbi] = mad_bit_read(ptr, slen1); |
| + bits_left -= slen1; |
| + } |
| } |
| |
| if (scfsi & 0x4) { |
| @@ -754,8 +776,12 @@ unsigned int III_scalefactors(struct mad |
| channel->scalefac[sfbi] = gr0ch->scalefac[sfbi]; |
| } |
| else { |
| - for (sfbi = 6; sfbi < 11; ++sfbi) |
| + for (sfbi = 6; sfbi < 11; ++sfbi) { |
| + if (bits_left < slen1) |
| + return MAD_ERROR_BADSCFSI; |
| channel->scalefac[sfbi] = mad_bit_read(ptr, slen1); |
| + bits_left -= slen1; |
| + } |
| } |
| |
| if (scfsi & 0x2) { |
| @@ -763,8 +789,12 @@ unsigned int III_scalefactors(struct mad |
| channel->scalefac[sfbi] = gr0ch->scalefac[sfbi]; |
| } |
| else { |
| - for (sfbi = 11; sfbi < 16; ++sfbi) |
| + for (sfbi = 11; sfbi < 16; ++sfbi) { |
| + if (bits_left < slen2) |
| + return MAD_ERROR_BADSCFSI; |
| channel->scalefac[sfbi] = mad_bit_read(ptr, slen2); |
| + bits_left -= slen2; |
| + } |
| } |
| |
| if (scfsi & 0x1) { |
| @@ -772,14 +802,19 @@ unsigned int III_scalefactors(struct mad |
| channel->scalefac[sfbi] = gr0ch->scalefac[sfbi]; |
| } |
| else { |
| - for (sfbi = 16; sfbi < 21; ++sfbi) |
| + for (sfbi = 16; sfbi < 21; ++sfbi) { |
| + if (bits_left < slen2) |
| + return MAD_ERROR_BADSCFSI; |
| channel->scalefac[sfbi] = mad_bit_read(ptr, slen2); |
| + bits_left -= slen2; |
| + } |
| } |
| |
| channel->scalefac[21] = 0; |
| } |
| |
| - return mad_bit_length(&start, ptr); |
| + *part2_length = mad_bit_length(&start, ptr); |
| + return MAD_ERROR_NONE; |
| } |
| |
| /* |
| @@ -933,19 +968,17 @@ static |
| enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576], |
| struct channel *channel, |
| unsigned char const *sfbwidth, |
| - unsigned int part2_length) |
| + signed int part3_length) |
| { |
| signed int exponents[39], exp; |
| signed int const *expptr; |
| struct mad_bitptr peek; |
| - signed int bits_left, cachesz; |
| + signed int bits_left, cachesz, fakebits; |
| register mad_fixed_t *xrptr; |
| mad_fixed_t const *sfbound; |
| register unsigned long bitcache; |
| |
| - bits_left = (signed) channel->part2_3_length - (signed) part2_length; |
| - if (bits_left < 0) |
| - return MAD_ERROR_BADPART3LEN; |
| + bits_left = part3_length; |
| |
| III_exponents(channel, sfbwidth, exponents); |
| |
| @@ -956,8 +989,12 @@ enum mad_error III_huffdecode(struct mad |
| cachesz = mad_bit_bitsleft(&peek); |
| cachesz += ((32 - 1 - 24) + (24 - cachesz)) & ~7; |
| |
| + if (bits_left < cachesz) { |
| + cachesz = bits_left; |
| + } |
| bitcache = mad_bit_read(&peek, cachesz); |
| bits_left -= cachesz; |
| + fakebits = 0; |
| |
| xrptr = &xr[0]; |
| |
| @@ -986,7 +1023,7 @@ enum mad_error III_huffdecode(struct mad |
| |
| big_values = channel->big_values; |
| |
| - while (big_values-- && cachesz + bits_left > 0) { |
| + while (big_values-- && cachesz + bits_left - fakebits > 0) { |
| union huffpair const *pair; |
| unsigned int clumpsz, value; |
| register mad_fixed_t requantized; |
| @@ -1023,10 +1060,19 @@ enum mad_error III_huffdecode(struct mad |
| unsigned int bits; |
| |
| bits = ((32 - 1 - 21) + (21 - cachesz)) & ~7; |
| + if (bits_left < bits) { |
| + bits = bits_left; |
| + } |
| bitcache = (bitcache << bits) | mad_bit_read(&peek, bits); |
| cachesz += bits; |
| bits_left -= bits; |
| } |
| + if (cachesz < 21) { |
| + unsigned int bits = 21 - cachesz; |
| + bitcache <<= bits; |
| + cachesz += bits; |
| + fakebits += bits; |
| + } |
| |
| /* hcod (0..19) */ |
| |
| @@ -1041,6 +1087,8 @@ enum mad_error III_huffdecode(struct mad |
| } |
| |
| cachesz -= pair->value.hlen; |
| + if (cachesz < fakebits) |
| + return MAD_ERROR_BADHUFFDATA; |
| |
| if (linbits) { |
| /* x (0..14) */ |
| @@ -1054,10 +1102,15 @@ enum mad_error III_huffdecode(struct mad |
| |
| case 15: |
| if (cachesz < linbits + 2) { |
| - bitcache = (bitcache << 16) | mad_bit_read(&peek, 16); |
| - cachesz += 16; |
| - bits_left -= 16; |
| + unsigned int bits = 16; |
| + if (bits_left < 16) |
| + bits = bits_left; |
| + bitcache = (bitcache << bits) | mad_bit_read(&peek, bits); |
| + cachesz += bits; |
| + bits_left -= bits; |
| } |
| + if (cachesz - fakebits < linbits) |
| + return MAD_ERROR_BADHUFFDATA; |
| |
| value += MASK(bitcache, cachesz, linbits); |
| cachesz -= linbits; |
| @@ -1074,6 +1127,8 @@ enum mad_error III_huffdecode(struct mad |
| } |
| |
| x_final: |
| + if (cachesz - fakebits < 1) |
| + return MAD_ERROR_BADHUFFDATA; |
| xrptr[0] = MASK1BIT(bitcache, cachesz--) ? |
| -requantized : requantized; |
| } |
| @@ -1089,10 +1144,15 @@ enum mad_error III_huffdecode(struct mad |
| |
| case 15: |
| if (cachesz < linbits + 1) { |
| - bitcache = (bitcache << 16) | mad_bit_read(&peek, 16); |
| - cachesz += 16; |
| - bits_left -= 16; |
| + unsigned int bits = 16; |
| + if (bits_left < 16) |
| + bits = bits_left; |
| + bitcache = (bitcache << bits) | mad_bit_read(&peek, bits); |
| + cachesz += bits; |
| + bits_left -= bits; |
| } |
| + if (cachesz - fakebits < linbits) |
| + return MAD_ERROR_BADHUFFDATA; |
| |
| value += MASK(bitcache, cachesz, linbits); |
| cachesz -= linbits; |
| @@ -1109,6 +1169,8 @@ enum mad_error III_huffdecode(struct mad |
| } |
| |
| y_final: |
| + if (cachesz - fakebits < 1) |
| + return MAD_ERROR_BADHUFFDATA; |
| xrptr[1] = MASK1BIT(bitcache, cachesz--) ? |
| -requantized : requantized; |
| } |
| @@ -1128,6 +1190,8 @@ enum mad_error III_huffdecode(struct mad |
| requantized = reqcache[value] = III_requantize(value, exp); |
| } |
| |
| + if (cachesz - fakebits < 1) |
| + return MAD_ERROR_BADHUFFDATA; |
| xrptr[0] = MASK1BIT(bitcache, cachesz--) ? |
| -requantized : requantized; |
| } |
| @@ -1146,6 +1210,8 @@ enum mad_error III_huffdecode(struct mad |
| requantized = reqcache[value] = III_requantize(value, exp); |
| } |
| |
| + if (cachesz - fakebits < 1) |
| + return MAD_ERROR_BADHUFFDATA; |
| xrptr[1] = MASK1BIT(bitcache, cachesz--) ? |
| -requantized : requantized; |
| } |
| @@ -1155,9 +1221,6 @@ enum mad_error III_huffdecode(struct mad |
| } |
| } |
| |
| - if (cachesz + bits_left < 0) |
| - return MAD_ERROR_BADHUFFDATA; /* big_values overrun */ |
| - |
| /* count1 */ |
| { |
| union huffquad const *table; |
| @@ -1167,15 +1230,24 @@ enum mad_error III_huffdecode(struct mad |
| |
| requantized = III_requantize(1, exp); |
| |
| - while (cachesz + bits_left > 0 && xrptr <= &xr[572]) { |
| + while (cachesz + bits_left - fakebits > 0 && xrptr <= &xr[572]) { |
| union huffquad const *quad; |
| |
| /* hcod (1..6) */ |
| |
| if (cachesz < 10) { |
| - bitcache = (bitcache << 16) | mad_bit_read(&peek, 16); |
| - cachesz += 16; |
| - bits_left -= 16; |
| + unsigned int bits = 16; |
| + if (bits_left < 16) |
| + bits = bits_left; |
| + bitcache = (bitcache << bits) | mad_bit_read(&peek, bits); |
| + cachesz += bits; |
| + bits_left -= bits; |
| + } |
| + if (cachesz < 10) { |
| + unsigned int bits = 10 - cachesz; |
| + bitcache <<= bits; |
| + cachesz += bits; |
| + fakebits += bits; |
| } |
| |
| quad = &table[MASK(bitcache, cachesz, 4)]; |
| @@ -1188,6 +1260,11 @@ enum mad_error III_huffdecode(struct mad |
| MASK(bitcache, cachesz, quad->ptr.bits)]; |
| } |
| |
| + if (cachesz - fakebits < quad->value.hlen + quad->value.v |
| + + quad->value.w + quad->value.x + quad->value.y) |
| + /* We don't have enough bits to read one more entry, consider them |
| + * stuffing bits. */ |
| + break; |
| cachesz -= quad->value.hlen; |
| |
| if (xrptr == sfbound) { |
| @@ -1236,22 +1313,8 @@ enum mad_error III_huffdecode(struct mad |
| |
| xrptr += 2; |
| } |
| - |
| - if (cachesz + bits_left < 0) { |
| -# if 0 && defined(DEBUG) |
| - fprintf(stderr, "huffman count1 overrun (%d bits)\n", |
| - -(cachesz + bits_left)); |
| -# endif |
| - |
| - /* technically the bitstream is misformatted, but apparently |
| - some encoders are just a bit sloppy with stuffing bits */ |
| - |
| - xrptr -= 4; |
| - } |
| } |
| |
| - assert(-bits_left <= MAD_BUFFER_GUARD * CHAR_BIT); |
| - |
| # if 0 && defined(DEBUG) |
| if (bits_left < 0) |
| fprintf(stderr, "read %d bits too many\n", -bits_left); |
| @@ -2348,10 +2411,11 @@ void III_freqinver(mad_fixed_t sample[18 |
| */ |
| static |
| enum mad_error III_decode(struct mad_bitptr *ptr, struct mad_frame *frame, |
| - struct sideinfo *si, unsigned int nch) |
| + struct sideinfo *si, unsigned int nch, unsigned int md_len) |
| { |
| struct mad_header *header = &frame->header; |
| unsigned int sfreqi, ngr, gr; |
| + int bits_left = md_len * CHAR_BIT; |
| |
| { |
| unsigned int sfreq; |
| @@ -2383,6 +2447,7 @@ enum mad_error III_decode(struct mad_bit |
| for (ch = 0; ch < nch; ++ch) { |
| struct channel *channel = &granule->ch[ch]; |
| unsigned int part2_length; |
| + unsigned int part3_length; |
| |
| sfbwidth[ch] = sfbwidth_table[sfreqi].l; |
| if (channel->block_type == 2) { |
| @@ -2391,18 +2456,30 @@ enum mad_error III_decode(struct mad_bit |
| } |
| |
| if (header->flags & MAD_FLAG_LSF_EXT) { |
| - part2_length = III_scalefactors_lsf(ptr, channel, |
| + error = III_scalefactors_lsf(ptr, channel, |
| ch == 0 ? 0 : &si->gr[1].ch[1], |
| - header->mode_extension); |
| + header->mode_extension, bits_left, &part2_length); |
| } |
| else { |
| - part2_length = III_scalefactors(ptr, channel, &si->gr[0].ch[ch], |
| - gr == 0 ? 0 : si->scfsi[ch]); |
| + error = III_scalefactors(ptr, channel, &si->gr[0].ch[ch], |
| + gr == 0 ? 0 : si->scfsi[ch], bits_left, &part2_length); |
| } |
| + if (error) |
| + return error; |
| + |
| + bits_left -= part2_length; |
| |
| - error = III_huffdecode(ptr, xr[ch], channel, sfbwidth[ch], part2_length); |
| + if (part2_length > channel->part2_3_length) |
| + return MAD_ERROR_BADPART3LEN; |
| + |
| + part3_length = channel->part2_3_length - part2_length; |
| + if (part3_length > bits_left) |
| + return MAD_ERROR_BADPART3LEN; |
| + |
| + error = III_huffdecode(ptr, xr[ch], channel, sfbwidth[ch], part3_length); |
| if (error) |
| return error; |
| + bits_left -= part3_length; |
| } |
| |
| /* joint stereo processing */ |
| @@ -2519,11 +2596,13 @@ int mad_layer_III(struct mad_stream *str |
| unsigned int nch, priv_bitlen, next_md_begin = 0; |
| unsigned int si_len, data_bitlen, md_len; |
| unsigned int frame_space, frame_used, frame_free; |
| - struct mad_bitptr ptr; |
| + struct mad_bitptr ptr, bufend_ptr; |
| struct sideinfo si; |
| enum mad_error error; |
| int result = 0; |
| |
| + mad_bit_init(&bufend_ptr, stream->bufend); |
| + |
| /* allocate Layer III dynamic structures */ |
| |
| if (stream->main_data == 0) { |
| @@ -2587,14 +2666,15 @@ int mad_layer_III(struct mad_stream *str |
| unsigned long header; |
| |
| mad_bit_init(&peek, stream->next_frame); |
| + if (mad_bit_length(&peek, &bufend_ptr) >= 57) { |
| + header = mad_bit_read(&peek, 32); |
| + if ((header & 0xffe60000L) /* syncword | layer */ == 0xffe20000L) { |
| + if (!(header & 0x00010000L)) /* protection_bit */ |
| + mad_bit_skip(&peek, 16); /* crc_check */ |
| |
| - header = mad_bit_read(&peek, 32); |
| - if ((header & 0xffe60000L) /* syncword | layer */ == 0xffe20000L) { |
| - if (!(header & 0x00010000L)) /* protection_bit */ |
| - mad_bit_skip(&peek, 16); /* crc_check */ |
| - |
| - next_md_begin = |
| - mad_bit_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8); |
| + next_md_begin = |
| + mad_bit_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8); |
| + } |
| } |
| |
| mad_bit_finish(&peek); |
| @@ -2653,7 +2733,7 @@ int mad_layer_III(struct mad_stream *str |
| /* decode main_data */ |
| |
| if (result == 0) { |
| - error = III_decode(&ptr, frame, &si, nch); |
| + error = III_decode(&ptr, frame, &si, nch, md_len); |
| if (error) { |
| stream->error = error; |
| result = -1; |