search for: opus_packet_parse_impl

Hello, there is a chance for an integer overflow in opus_packet_parse_impl(): int padding=0; int p; do { if (len<=0) return OPUS_INVALID_PACKET; p = *data++; len--; padding += p==255 ? 254: p; } while (p==255); len -= padding; ... if (len<0) return OPUS_INVALID_PACKET; When ~16 MB of 0xff bytes is fed to...

...oo {char c; union { void* p; opus_int32 i; opus_val32 v; } u;}; + + int alignment = offsetof(struct foo, u); + + /* Optimizing compilers should optimize div and multiply into and + for all sensible alignment values. */ + return ((i + alignment - 1) / alignment) * alignment; } int opus_packet_parse_impl(const unsigned char *data, opus_int32 len, -- 2.3.2 (Apple Git-55)

...epacketizer_cat() to cat the individual frame which is code3CBR that the padding part will be discard(code is below within red), then the length is not equal with the individual frame which is code0 or other code3CBR, and I think is this a fault? opus_repacketizer_cat()->opus_packet_parse()->opus_packet_parse_impl():switch (toc&0x3) default: /*case 3:*/ if (len<1) return OPUS_INVALID_PACKET; /* Number of frames encoded in bits 0 to 5 */ ch = *data++; count = ch&0x3F; if (count <= 0 || framesize*count > 5760) return OPUS_INVALID_PACKET; le...

...c/opusenc.c:604: undefined reference to `opus_strerror' /home/user/source/opus-tools/src/opusenc.c:598: undefined reference to `opus_strerror' src/opusenc.o:/home/user/source/opus-tools/src/opusenc.c:624: more undefined references to `opus_strerror' follow src/diag_range.o: In function `opus_packet_parse_impl': /home/user/source/opus-tools/src/diag_range.c:87: undefined reference to `opus_packet_get_samples_per_frame' src/diag_range.o: In function `save_range': /home/user/source/opus-tools/src/diag_range.c:237: undefined reference to `opus_packet_get_samples_per_frame' /home/user/source/...