search for: predictor_order

...d13b23b..211b4db 100644 --- a/src/libFLAC/stream_decoder.c +++ b/src/libFLAC/stream_decoder.c @@ -1281,9 +1281,6 @@ FLAC__bool allocate_output_(FLAC__StreamDecoder *decoder, unsigned size, unsigne unsigned i; FLAC__int32 *tmp; - /* Make sure size is some sensible minimum value. Plumb through predictor_order maybe? */ - size = size < FLAC__MAX_LPC_ORDER ? FLAC__MAX_LPC_ORDER : size ; - if(size <= decoder->private_->output_capacity && channels <= decoder->private_->output_channels) return true; @@ -2594,6 +2591,11 @@ FLAC__bool read_subframe_fixed_(FLAC__StreamDecoder...

...ned channel, unsigned bps, const unsigned order, FLAC__bool do_full_decode); static FLAC__bool read_subframe_verbatim_(FLAC__StreamDecoder *decoder, unsigned channel, unsigned bps, FLAC__bool do_full_decode); -static FLAC__bool read_residual_partitioned_rice_(FLAC__StreamDecoder *decoder, unsigned predictor_order, unsigned partition_order, FLAC__EntropyCodingMethod_PartitionedRiceContents *partitioned_rice_contents, FLAC__int32 *residual, FLAC__bool is_extended); +static FLAC__bool read_residual_partitioned_rice_(FLAC__StreamDecoder *decoder, unsigned predictor_order, unsigned partition_order, FLAC__Entropy...

On Thu, Jun 19, 2014 at 03:30:22PM +0400, lvqcl wrote: > BTW, what can you say about the following place in stream_decoder.c > in read_subframe_lpc_() function: > > /*@@@@@@ technically not pessimistic enough, should be more like > if( (FLAC__uint64)order * ((((FLAC__uint64)1)<<bps)-1) * ((1<<subframe->qlp_coeff_precision)-1) < (((FLAC__uint64)-1)

Hi all, Google Security Team member, Michele Spagnuolo, recently found two potential problems in the FLAC code base. They are : CVE-2014-9028 : Heap buffer write overflow CVE-2014-8962 : Heap buffer read overflow For Linux distributions, the specific fixes for these two CVEs are available from Git here:

...blocksize-order in > the caller would still underflow. > > --- a/src/libFLAC/stream_decoder.c > +++ b/src/libFLAC/stream_decoder.c > @@ -2744,7 +2744,7 @@ FLAC__bool read_residual_partitioned_rice_(FLAC__StreamDecoder *decoder, unsigne > if(partition_samples < predictor_order) { > send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC); > decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC; > - return true; > + return fals...

...FLAC/format.h" diff --git a/src/libFLAC/stream_encoder.c b/src/libFLAC/stream_encoder.c index e64ece2..8928a39 100644 --- a/src/libFLAC/stream_encoder.c +++ b/src/libFLAC/stream_encoder.c @@ -3872,10 +3872,9 @@ void precompute_partition_info_sums_( FLAC__ASSERT(default_partition_samples > predictor_order); #if defined(FLAC__CPU_IA32) && !defined FLAC__NO_ASM && defined FLAC__HAS_NASM && 0 - /* WATCHOUT: "+ bps" is an assumption that the average residual magnitude will not be more than "bps" bits */ - /* previously the condition was: if(FLAC__bitmath_il...

...k max_rice_partition_order++; blocksize >>= 1; } - return min(FLAC__MAX_RICE_PARTITION_ORDER, max_rice_partition_order); + return flac_min(FLAC__MAX_RICE_PARTITION_ORDER, max_rice_partition_order); } unsigned FLAC__format_get_max_rice_partition_order_from_blocksize_limited_max_and_predictor_order(unsigned limit, unsigned blocksize, unsigned predictor_order) diff --git a/src/libFLAC/include/private/macros.h b/src/libFLAC/include/private/macros.h new file mode 100644 index 0000000..1718005 --- /dev/null +++ b/src/libFLAC/include/private/macros.h @@ -0,0 +1,29 @@ +#ifndef FLAC__PRIVATE__MACROS...

...blocksize-order in > the caller would still underflow. > > --- a/src/libFLAC/stream_decoder.c > +++ b/src/libFLAC/stream_decoder.c > @@ -2744,7 +2744,7 @@ FLAC__bool read_residual_partitioned_rice_(FLAC__StreamDecoder *decoder, unsigne > if(partition_samples < predictor_order) { > send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC); > decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC; > - return true; > + return fa...

...es (bb=0x4085c800, bits=268435453) at bitbuffer.c:254 #5 0x8061153 in FLAC__bitbuffer_write_rice_signed (bb=0x4085c800, val=-2147483630, parameter=4) at bitbuffer.c:658 #6 0x8056603 in subframe_add_residual_partitioned_rice_ (bb=0x4085c800, residual=0x8361200, residual_samples=4580, predictor_order=28, rice_parameters=0x407dc520, raw_bits=0x407fc520, partition_order=0) at encoder_framing.c:366 #7 0x80563eb in FLAC__subframe_add_lpc (subframe=0x407dc518, residual_samples=4580, subframe_bps=17, wasted_bits=0, bb=0x4085c800) at encoder_framing.c:310 #8 0x80544c8 in encoder_ad...

...function would return true and blocksize-order in the caller would still underflow. --- a/src/libFLAC/stream_decoder.c +++ b/src/libFLAC/stream_decoder.c @@ -2744,7 +2744,7 @@ FLAC__bool read_residual_partitioned_rice_(FLAC__StreamDecoder *decoder, unsigne if(partition_samples < predictor_order) { send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC); decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC; - return true; + return false; }...

...low. > > > > --- a/src/libFLAC/stream_decoder.c > > +++ b/src/libFLAC/stream_decoder.c > > @@ -2744,7 +2744,7 @@ FLAC__bool > read_residual_partitioned_rice_(FLAC__StreamDecoder *decoder, unsigne > > if(partition_samples < predictor_order) { > > send_error_to_client_(decoder, > FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC); > > decoder->protected_->state = > FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC; > > - return true; > > + retur...

...gt; the caller would still underflow. >> >> --- a/src/libFLAC/stream_decoder.c >> +++ b/src/libFLAC/stream_decoder.c >> @@ -2744,7 +2744,7 @@ FLAC__bool read_residual_partitioned_rice_(FLAC__StreamDecoder *decoder, unsigne >> if(partition_samples < predictor_order) { >> send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC); >> decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC; >> - return true; >> +...

...\202\"?\235\220?\212Us??v??f??\231%\233??qJ??oLF\024???>?j%\237??" i = 44552 j = 8 val_i = 70816 cbits = 1 uval = 631 msbs = 1 lsbs_left = 1 blurb = 158 '\236' save_blurb = 196 '?' state = 1 #1 0x4021f88d in read_residual_partitioned_rice_ (decoder=0x805ba58, predictor_order=3, partition_order=14, partitioned_rice_contents=0x805f478, residual=0x807dd80) at stream_decoder.c:1975 rice_parameter = 9 i = 2 partition = 0 sample = 0 u = 4294967293 partitions = 16384 partition_samples = 0 #2 0x4021f01f in read_subframe_fixed_ (decoder=0x805ba58, channel=1, bps=16...

> > I also had this verify error encoding a wav I ripped from a CD. I > didn't > > report this as it happended on flac running on debian linux > -current unstable. > > This error happened only with one track of a CD I was ripping. > > > > Another reason for me not reporting this was, that flac 1.0 running > on OpenBSD > > 2.9 encoded the wav with

I think I've gotten FLAC__lpc_restore_signal() about as good as I'm going to get it. Here's what I have: -a new file, lpc_asm.s, which has the assembly routines -changes to cpu.h, cpu.c, and stream_decoder.c to enable them -changes to configure.in to support the new cpu stuff -a preliminary Makefile.am -maybe something else I'm forgetting Now automake complains that configure.in

...************** *** 1965,1970 **** --- 1986,1993 ---- const unsigned partitions = 1u << partition_order; const unsigned partition_samples = partition_order > 0? decoder->private_->frame.header.blocksize >> partition_order : decoder->private_->frame.header.blocksize - predictor_order; + FLAC__ASSERT((((long)residual) & 0xf) == 0); + if(!FLAC__format_entropy_coding_method_partitioned_rice_contents_ensure_size(partitioned_rice_contents, max(6, partition_order))) { decoder->protected_->state = FLAC__STREAM_DECODER_MEMORY_ALLOCATION_ERROR; return false; --...