Skip to content

Commit

Permalink
CVE-2017-14633: Don't allow for more than 256 channels
Browse files Browse the repository at this point in the history
Otherwise

 for(i=0;i<vi->channels;i++){
      /* the encoder setup assumes that all the modes used by any
         specific bitrate tweaking use the same floor */
      int submap=info->chmuxlist[i];

overreads later in mapping0_forward since chmuxlist is a fixed array of
256 elements max.
  • Loading branch information
agx authored and tdaede committed Dec 11, 2017
1 parent c784057 commit a79ec21
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion lib/info.c
Expand Up @@ -588,7 +588,7 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v,
oggpack_buffer opb;
private_state *b=v->backend_state;

if(!b||vi->channels<=0){
if(!b||vi->channels<=0||vi->channels>256){
ret=OV_EFAULT;
goto err_out;
}
Expand Down

0 comments on commit a79ec21

Please sign in to comment.