summaryrefslogtreecommitdiff
path: root/gnu/packages/patches/libmad-frame-length.patch
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/packages/patches/libmad-frame-length.patch')
-rw-r--r--gnu/packages/patches/libmad-frame-length.patch199
1 files changed, 199 insertions, 0 deletions
diff --git a/gnu/packages/patches/libmad-frame-length.patch b/gnu/packages/patches/libmad-frame-length.patch
new file mode 100644
index 00000000000..3434eba5777
--- /dev/null
+++ b/gnu/packages/patches/libmad-frame-length.patch
@@ -0,0 +1,199 @@
1Copied from Debian.
2
3; You can calculate where the next frame will start depending on things
4; like the bitrate. See mad_header_decode(). It seems that when decoding
5; the frame you can go past that boundary. This attempts to catch those cases,
6; but might not catch all of them.
7; For more info see http://bugs.debian.org/508133
8Index: libmad-0.15.1b/layer12.c
9===================================================================
10--- libmad-0.15.1b.orig/layer12.c 2008-12-23 21:38:07.000000000 +0100
11+++ libmad-0.15.1b/layer12.c 2008-12-23 21:38:12.000000000 +0100
12@@ -134,6 +134,12 @@
13 for (sb = 0; sb < bound; ++sb) {
14 for (ch = 0; ch < nch; ++ch) {
15 nb = mad_bit_read(&stream->ptr, 4);
16+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
17+ {
18+ stream->error = MAD_ERROR_LOSTSYNC;
19+ stream->sync = 0;
20+ return -1;
21+ }
22
23 if (nb == 15) {
24 stream->error = MAD_ERROR_BADBITALLOC;
25@@ -146,6 +152,12 @@
26
27 for (sb = bound; sb < 32; ++sb) {
28 nb = mad_bit_read(&stream->ptr, 4);
29+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
30+ {
31+ stream->error = MAD_ERROR_LOSTSYNC;
32+ stream->sync = 0;
33+ return -1;
34+ }
35
36 if (nb == 15) {
37 stream->error = MAD_ERROR_BADBITALLOC;
38@@ -162,6 +174,12 @@
39 for (ch = 0; ch < nch; ++ch) {
40 if (allocation[ch][sb]) {
41 scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
42+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
43+ {
44+ stream->error = MAD_ERROR_LOSTSYNC;
45+ stream->sync = 0;
46+ return -1;
47+ }
48
49 # if defined(OPT_STRICT)
50 /*
51@@ -187,6 +205,12 @@
52 frame->sbsample[ch][s][sb] = nb ?
53 mad_f_mul(I_sample(&stream->ptr, nb),
54 sf_table[scalefactor[ch][sb]]) : 0;
55+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
56+ {
57+ stream->error = MAD_ERROR_LOSTSYNC;
58+ stream->sync = 0;
59+ return -1;
60+ }
61 }
62 }
63
64@@ -195,6 +219,12 @@
65 mad_fixed_t sample;
66
67 sample = I_sample(&stream->ptr, nb);
68+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
69+ {
70+ stream->error = MAD_ERROR_LOSTSYNC;
71+ stream->sync = 0;
72+ return -1;
73+ }
74
75 for (ch = 0; ch < nch; ++ch) {
76 frame->sbsample[ch][s][sb] =
77@@ -403,7 +433,15 @@
78 nbal = bitalloc_table[offsets[sb]].nbal;
79
80 for (ch = 0; ch < nch; ++ch)
81+ {
82 allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
83+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
84+ {
85+ stream->error = MAD_ERROR_LOSTSYNC;
86+ stream->sync = 0;
87+ return -1;
88+ }
89+ }
90 }
91
92 for (sb = bound; sb < sblimit; ++sb) {
93@@ -411,6 +449,13 @@
94
95 allocation[0][sb] =
96 allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
97+
98+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
99+ {
100+ stream->error = MAD_ERROR_LOSTSYNC;
101+ stream->sync = 0;
102+ return -1;
103+ }
104 }
105
106 /* decode scalefactor selection info */
107@@ -419,6 +464,12 @@
108 for (ch = 0; ch < nch; ++ch) {
109 if (allocation[ch][sb])
110 scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
111+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
112+ {
113+ stream->error = MAD_ERROR_LOSTSYNC;
114+ stream->sync = 0;
115+ return -1;
116+ }
117 }
118 }
119
120@@ -442,6 +493,12 @@
121 for (ch = 0; ch < nch; ++ch) {
122 if (allocation[ch][sb]) {
123 scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
124+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
125+ {
126+ stream->error = MAD_ERROR_LOSTSYNC;
127+ stream->sync = 0;
128+ return -1;
129+ }
130
131 switch (scfsi[ch][sb]) {
132 case 2:
133@@ -452,11 +509,23 @@
134
135 case 0:
136 scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
137+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
138+ {
139+ stream->error = MAD_ERROR_LOSTSYNC;
140+ stream->sync = 0;
141+ return -1;
142+ }
143 /* fall through */
144
145 case 1:
146 case 3:
147 scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
148+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
149+ {
150+ stream->error = MAD_ERROR_LOSTSYNC;
151+ stream->sync = 0;
152+ return -1;
153+ }
154 }
155
156 if (scfsi[ch][sb] & 1)
157@@ -488,6 +557,12 @@
158 index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
159
160 II_samples(&stream->ptr, &qc_table[index], samples);
161+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
162+ {
163+ stream->error = MAD_ERROR_LOSTSYNC;
164+ stream->sync = 0;
165+ return -1;
166+ }
167
168 for (s = 0; s < 3; ++s) {
169 frame->sbsample[ch][3 * gr + s][sb] =
170@@ -506,6 +581,12 @@
171 index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
172
173 II_samples(&stream->ptr, &qc_table[index], samples);
174+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
175+ {
176+ stream->error = MAD_ERROR_LOSTSYNC;
177+ stream->sync = 0;
178+ return -1;
179+ }
180
181 for (ch = 0; ch < nch; ++ch) {
182 for (s = 0; s < 3; ++s) {
183Index: libmad-0.15.1b/layer3.c
184===================================================================
185--- libmad-0.15.1b.orig/layer3.c 2008-12-23 21:38:07.000000000 +0100
186+++ libmad-0.15.1b/layer3.c 2008-12-23 21:38:12.000000000 +0100
187@@ -2608,6 +2608,12 @@
188 next_md_begin = 0;
189
190 md_len = si.main_data_begin + frame_space - next_md_begin;
191+ if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN)
192+ {
193+ stream->error = MAD_ERROR_LOSTSYNC;
194+ stream->sync = 0;
195+ return -1;
196+ }
197
198 frame_used = 0;
199
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-03 06:16:35 +0000