shithub: opus

Info  •  Files  •  Log  •  Branches

Simple check that application supplied packet length is not negative.

--- a/libcelt/celt.c

+++ b/libcelt/celt.c

@@ -405,6 +405,9 @@

    if (check_mode(st->mode) != CELT_OK)

       return CELT_INVALID_MODE;

+   if (nbCompressedBytes<0)

+     return CELT_BAD_ARG; 

+

    /* The memset is important for now in case the encoder doesn't fill up all the bytes */

    CELT_MEMSET(compressed, 0, nbCompressedBytes);

    ec_byte_writeinit_buffer(&buf, compressed, nbCompressedBytes);

@@ -957,6 +960,10 @@

       celt_decode_lost(st, pcm);

       RESTORE_STACK;

       return 0;

+   }

+   if (len<0) {

+     RESTORE_STACK;

+     return CELT_BAD_ARG;

    }

    ec_byte_readinit(&buf,data,len);

--- a/libcelt/testcelt.c

+++ b/libcelt/testcelt.c

@@ -40,6 +40,8 @@

 #include <math.h>

 #include <string.h>

+#define MAX_PACKET 1024

+

 int main(int argc, char *argv[])

 {

    char *inFile, *outFile;

@@ -50,7 +52,7 @@

    int len;

    celt_int32_t frame_size, channels;

    int bytes_per_packet;

-   unsigned char data[1024];

+   unsigned char data[MAX_PACKET];

    int rate;

    int complexity;

 #if !(defined (FIXED_POINT) && defined(STATIC_MODES))

@@ -79,9 +81,9 @@

    }

    bytes_per_packet = atoi(argv[4]);

-   if (bytes_per_packet < 0 || bytes_per_packet > 200)

+   if (bytes_per_packet < 0 || bytes_per_packet > MAX_PACKET)

    {

-      fprintf (stderr, "bytes per packet must be between 10 and 200\n");

+      fprintf (stderr, "bytes per packet must be between 0 and %d\n",MAX_PACKET);

       return 1;

    }