eden-emu/opus
19
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reject more invalid packets in the decoder.

Browse source 
Code 3 packets with 0 frames are now invalid, and any packet with a
 frame larger than 1275 bytes is invalid (to allow for
 repacketization).
This commit is contained in:
Timothy B. Terriberry 2011-05-10 10:54:12 -07:00 • committed by Jean-Marc Valin
parent af1f538573
commit a11795c47e
1 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/opus_decoder.c
View file

@ -39,6 +39,8 @@
#include "modes.h" #include "modes.h"
#include "SKP_Silk_SDK_API.h" #include "SKP_Silk_SDK_API.h"
#define MAX_PACKET (1275)
/* Make sure everything's aligned to 4 bytes (this may need to be increased /* Make sure everything's aligned to 4 bytes (this may need to be increased
on really weird architectures) */ on really weird architectures) */
static inline int align(int i) static inline int align(int i)
@ -433,7 +435,7 @@ int opus_decode(OpusDecoder *st, const unsigned char *data,
/* Number of frames encoded in bits 0 to 5 */ /* Number of frames encoded in bits 0 to 5 */
ch = *data++; ch = *data++;
count = ch&0x3F; count = ch&0x3F;
if (st->frame_size*count*25 > 3*st->Fs) if (count <= 0 || st->frame_size*count*25 > 3*st->Fs)
return OPUS_CORRUPTED_DATA; return OPUS_CORRUPTED_DATA;
len--; len--;
/* Padding bit */ /* Padding bit */
@ -468,11 +470,10 @@ int opus_decode(OpusDecoder *st, const unsigned char *data,
} }
if (last_size<0) if (last_size<0)
return OPUS_CORRUPTED_DATA; return OPUS_CORRUPTED_DATA;
if (count) size[count-1]=last_size;
size[count-1]=last_size;
} else { } else {
/* CBR case */ /* CBR case */
int sz = count != 0 ? len/count : 0; int sz = len/count;
if (sz*count!=len) if (sz*count!=len)
return OPUS_CORRUPTED_DATA; return OPUS_CORRUPTED_DATA;
for (i=0;i<count;i++) for (i=0;i<count;i++)
@ -480,6 +481,12 @@ int opus_decode(OpusDecoder *st, const unsigned char *data,
} }
break; break;
} }
/* Because it's not encoded explicitly, it's possible the size of the
last packet (or all the packets, for the CBR case) is larger than
1275.
Reject them here.*/
if (size[count-1] > MAX_PACKET)
return OPUS_CORRUPTED_DATA;
if (count*st->frame_size > frame_size) if (count*st->frame_size > frame_size)
return OPUS_BAD_ARG; return OPUS_BAD_ARG;
nb_samples=0; nb_samples=0;