Displaying 4 results from an estimated 4 matches for "nb_fields".
Did you mean:
n_fields
2018 Feb 09
3
[PATCH]Add address overflow check
Hi,
I came into a crash when using 32-bit `speexdec` and found that there's an
address overflow in function `print_comments()`:
static void print_comments(char *comments, int length)
{
char *c=comments;
int len, i, nb_fields;
char *end;
if (length<8)
{
fprintf (stderr, "Invalid/corrupted comments\n");
return;
}
end = c+length;
len=readint(c, 0);
c+=4;
// 'c+len' MAY OVERFLOW
if (len < 0 || c+len>end)
{
fprintf (stderr, "Invalid/c...
2018 Feb 09
0
[PATCH]Add address overflow check
...ikai Liu wrote:
> Hi,
>
> I came into a crash when using 32-bit `speexdec` and found that there's
> an address overflow in function `print_comments()`:
>
> staticvoidprint_comments(char*comments, intlength)
>
> {
>
> char*c=comments;
>
> intlen, i, nb_fields;
>
> char*end;
>
>
> if(length<8)
>
> {
>
> fprintf (stderr, "Invalid/corrupted comments\n");
>
> return;
>
> }
>
> end = c+length;
>
> len=readint(c, 0);
>
> c+=4;
>
> //...
2008 Apr 04
0
speexdec 1.2.3
...lt;<24)&0xff000000)| \
((buf[base+2]<<16)&0xff0000)| \
((buf[base+1]<<8)&0xff00)| \
(buf[base]&0xff))
static void print_comments(char *comments, int length)
{
char *c=comments;
int len, i, nb_fields;
char *end;
if (length<8)
{
fprintf (stderr, "Invalid/corrupted comments\n");
return;
}
end = c+length;
len=readint(c, 0);
c+=4;
if (c+len>end)
{
fprintf (stderr, "Invalid/corrupted comments\n");
return;
}
fwrite...
2008 Apr 04
2
speexdec 1.2.3
On Fri, Apr 4, 2008 at 12:19 AM, Jean-Marc Valin
<jean-marc.valin at usherbrooke.ca> wrote:
> Jahn, Ray (R.) a ?crit :
>
> > Dear Speex codec community:
> >
> > I am working on conversion of voice files. I could not figure out how to use speexdec.exe 1.2.3 in piped mode in order to avoid the creation of the potentially large intermediate *.wav or *.pcm files. Any