src/opus_decoder.c - Issue 11575026: Fix possible integer overflow in Opus with ~16MB fed to the decoder.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Unified Diff: src/opus_decoder.c

Issue 11575026: Fix possible integer overflow in Opus with ~16MB fed to the decoder. (Closed) Base URL: http://src.chromium.org/svn/trunk/

Patch Set: Fix possible integer overflow in Opus with ~16MB fed to the decoder. Created 8 years ago

Use n/p to move between diff chunks; N/P to move between comments.

Jump to:

Index: src/opus_decoder.c

===================================================================

--- src/opus_decoder.c (revision 173381)

+++ src/opus_decoder.c (working copy)

@@ -612,16 +612,14 @@

/* Padding flag is bit 6 */

if (ch&0x40)

{

- int padding=0;

int p;

do {

if (len<=0)

return OPUS_INVALID_PACKET;

p = *data++;

len--;

- padding += p==255 ? 254: p;

+ len -= p==255 ? 254: p;

} while (p==255);

- len -= padding;

}

if (len<0)

return OPUS_INVALID_PACKET;

« no previous file with comments | « no previous file | no next file » | no next file with comments »