Drew Allen
2017-Dec-05 00:08 UTC
[opus] [PATCH] Ensure mapping matrix size is always valid.
Hello, Attached is a patch that ensures only valid sizes of the mapping matrix are accepted. This patch depends on the most recent [PATCH] Fix memory issues in Projection API. Cheers, Drew -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.xiph.org/pipermail/opus/attachments/20171205/30a22002/attachment.html> -------------- next part -------------- A non-text attachment was scrubbed... Name: 0001-Ensure-mapping-matrix-size-is-always-valid.patch Type: text/x-patch Size: 5406 bytes Desc: not available URL: <http://lists.xiph.org/pipermail/opus/attachments/20171205/30a22002/attachment.bin>
Jean-Marc Valin
2017-Dec-07 22:12 UTC
[opus] [PATCH] Ensure mapping matrix size is always valid.
Looks good except for one detail: + size = rows * cols * sizeof(opus_int16); + if (rows > 255 || cols > 255 || size > 65004) That should probably be: + if (rows > 255 || cols > 255 || + rows * cols * sizeof(opus_int16) > 65004) instead. Otherwise, if you pass very large values for both rows and cols, then you can have an integer overflow before the test. Cheers, Jean-Marc On 12/04/2017 07:08 PM, Drew Allen wrote:> Hello, > > Attached is a patch that ensures only valid sizes of the mapping matrix > are accepted. > > This patch depends on the most recent [PATCH] Fix memory issues in > Projection API. > > Cheers, > Drew > > > _______________________________________________ > opus mailing list > opus at xiph.org > http://lists.xiph.org/mailman/listinfo/opus >
Jean-Marc Valin
2017-Dec-07 23:06 UTC
[opus] [PATCH] Ensure mapping matrix size is always valid.
See proposed modification to your patch to avoid integer overflows and work on 16-bit int platforms. Jean-Marc On 12/04/2017 07:08 PM, Drew Allen wrote:> Hello, > > Attached is a patch that ensures only valid sizes of the mapping matrix > are accepted. > > This patch depends on the most recent [PATCH] Fix memory issues in > Projection API. > > Cheers, > Drew > > > _______________________________________________ > opus mailing list > opus at xiph.org > http://lists.xiph.org/mailman/listinfo/opus >-------------- next part -------------- A non-text attachment was scrubbed... Name: 0001-Ensure-mapping-matrix-size-is-always-valid.patch Type: text/x-patch Size: 5425 bytes Desc: not available URL: <http://lists.xiph.org/pipermail/opus/attachments/20171207/7b09dea2/attachment.bin>
Drew Allen
2017-Dec-07 23:07 UTC
[opus] [PATCH] Ensure mapping matrix size is always valid.
Nice! Looks good, thanks! On Thu, Dec 7, 2017 at 3:06 PM Jean-Marc Valin <jmvalin at jmvalin.ca> wrote:> See proposed modification to your patch to avoid integer overflows and > work on 16-bit int platforms. > > Jean-Marc > > On 12/04/2017 07:08 PM, Drew Allen wrote: > > Hello, > > > > Attached is a patch that ensures only valid sizes of the mapping matrix > > are accepted. > > > > This patch depends on the most recent [PATCH] Fix memory issues in > > Projection API. > > > > Cheers, > > Drew > > > > > > _______________________________________________ > > opus mailing list > > opus at xiph.org > > http://lists.xiph.org/mailman/listinfo/opus > > >-------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.xiph.org/pipermail/opus/attachments/20171207/1303b2dd/attachment.html>