Skip to content
Permalink
Browse files

CVE-2019-7572: Fix a buffer overread in IMA_ADPCM_nibble

If an IMA ADPCM block contained an initial index out of step table
range (loaded in IMA_ADPCM_decode()), IMA_ADPCM_nibble() blindly used
this bogus value and that lead to a buffer overread.

This patch fixes it by moving clamping the index value at the
beginning of IMA_ADPCM_nibble() function instead of the end after
an update.

CVE-2019-7572
https://bugzilla.libsdl.org/show_bug.cgi?id=4495

Signed-off-by: Petr P?sa? <ppisar@redhat.com>
  • Loading branch information
ppisar committed Jun 9, 2019
1 parent d8bd7c9 commit 1ead4913fc2314a0ce5de06f29a20a8b0b0a5557

File 1 of 1 in 1ead491

@@ -264,6 +264,14 @@ static Sint32 IMA_ADPCM_nibble(struct IMA_ADPCM_decodestate *state,Uint8 nybble)
};
Sint32 delta, step;

/* Clamp index value. The inital value can be invalid. */
if ( state->index > 88 ) {
state->index = 88;
} else
if ( state->index < 0 ) {
state->index = 0;
}

/* Compute difference and new sample value */
step = step_table[state->index];
delta = step >> 3;
@@ -275,12 +283,6 @@ static Sint32 IMA_ADPCM_nibble(struct IMA_ADPCM_decodestate *state,Uint8 nybble)

/* Update index value */
state->index += index_table[nybble];
if ( state->index > 88 ) {
state->index = 88;
} else
if ( state->index < 0 ) {
state->index = 0;
}

/* Clamp output sample */
if ( state->sample > max_audioval ) {

0 comments on commit 1ead491

Please sign in to comment.