Please sign in to comment.
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
CVE-2019-7577: Fix a buffer overread in MS_ADPCM_nibble and MS_ADPCM_…
…decode If a chunk of RIFF/WAV file with MS ADPCM encoding contains an invalid predictor (a valid predictor's value is between 0 and 6 inclusive), a buffer overread can happen when the predictor is used as an index into an array of MS ADPCM coefficients. The overead happens when indexing MS_ADPCM_state.aCoeff array in MS_ADPCM_decode() and later when dereferencing a coef pointer in MS_ADPCM_nibble(). This patch fixes it by checking the MS ADPCM predictor values fit into the valid range. CVE-2019-7577 Reproducer: https://bugzilla.libsdl.org/show_bug.cgi?id=4492 Signed-off-by: Petr P?sa? <email@example.com>
- Loading branch information
Showing with 7 additions and 0 deletions.
- +7 −0 src/audio/SDL_wave.c