Skip to content

Commit

Permalink
Merge pull request #33 from hlef/master
Browse files Browse the repository at this point in the history 
CVE-2018-20194 / CVE-2018-20362 fixes
  • Loading branch information
@fabiangreffrath
fabiangreffrath authored Apr 11, 2019
2 parents 7da4a83 + 6b4a7cd commit a8dc3f8
Show file tree
Hide file tree
Showing 2 changed files with 30 additions and 0 deletions.
18 changes: 18 additions & 0 deletions libfaad/sbr_hfadj.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -485,6 +485,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch)
ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k];
ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1];

if (ml1 > MAX_M)
ml1 = MAX_M;

if (ml2 > MAX_M)
ml2 = MAX_M;


/* calculate the accumulated E_orig and E_curr over the limiter band */
for (m = ml1; m < ml2; m++)
Expand Down Expand Up @@ -949,6 +955,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch)
ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k];
ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1];

if (ml1 > MAX_M)
ml1 = MAX_M;

if (ml2 > MAX_M)
ml2 = MAX_M;


/* calculate the accumulated E_orig and E_curr over the limiter band */
for (m = ml1; m < ml2; m++)
Expand Down Expand Up @@ -1193,6 +1205,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch)
ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k];
ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1];

if (ml1 > MAX_M)
ml1 = MAX_M;

if (ml2 > MAX_M)
ml2 = MAX_M;


/* calculate the accumulated E_orig and E_curr over the limiter band */
for (m = ml1; m < ml2; m++)
Expand Down
12 changes: 12 additions & 0 deletions libfaad/syntax.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -344,6 +344,12 @@ static void decode_sce_lfe(NeAACDecStruct *hDecoder,
can become 2 when some form of Parametric Stereo coding is used
*/

if (hDecoder->frame && hDecoder->element_id[hDecoder->fr_ch_ele] != id_syn_ele) {
/* element inconsistency */
hInfo->error = 21;
return;
}

/* save the syntax element id */
hDecoder->element_id[hDecoder->fr_ch_ele] = id_syn_ele;

Expand Down Expand Up @@ -395,6 +401,12 @@ static void decode_cpe(NeAACDecStruct *hDecoder, NeAACDecFrameInfo *hInfo, bitfi
return;
}

if (hDecoder->frame && hDecoder->element_id[hDecoder->fr_ch_ele] != id_syn_ele) {
/* element inconsistency */
hInfo->error = 21;
return;
}

/* save the syntax element id */
hDecoder->element_id[hDecoder->fr_ch_ele] = id_syn_ele;

Expand Down

3 comments on commit a8dc3f8

@uklotzde
Copy link

@uklotzde uklotzde commented on a8dc3f8 Jan 1, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A user of Mixxx on Arch Linux reported that MP4/AAC files obtained from iTunes can no longer be decoded with libfaad2 2.9.1:

https://www.mixxx.org/forums/viewtopic.php?t=13157

I guess that this commit might be the cause of those issues.

@hlef
Copy link
Contributor

@hlef hlef commented on a8dc3f8 Jan 1, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There seems to be a regression somewhere, might also be due to 3b80a57. See the discussion at 920ec98.

I wanted to take a look at this for a while, but could not find time for this. Could you please open an issue? I'll do my best to have at least a temporary solution in the next days.

@uklotzde
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since I'm not able to reproduce the issues myself and investigations are underway opening a new issue should not be needed. Thanks for the quick reply and confirmation.

We have a fallback solution in place, but if the decoder doesn't fail during the configuration stage it won't work.

Please sign in to comment.