[xiph-commits] r17515 - trunk/Tremor

[tterribe at svn.xiph.org]

Author: tterribe
Date: 2010-10-13 16:12:19 -0700 (Wed, 13 Oct 2010)
New Revision: 17515

Modified:
   trunk/Tremor/backends.h
   trunk/Tremor/info.c
   trunk/Tremor/iseeking_example.c
   trunk/Tremor/ivorbisfile_example.c
   trunk/Tremor/res012.c
   trunk/Tremor/sharedbook.c
Log:
Fixes for r17514.

Actually allocate the right number of comments, and add an extra check against
 i+1 overflowing (which could happen with a 4 GB comment packet on a 64-bit
 machine... unlikely, but possible).


Modified: trunk/Tremor/backends.h
===================================================================
--- trunk/Tremor/backends.h	2010-10-13 20:58:52 UTC (rev 17514)
+++ trunk/Tremor/backends.h	2010-10-13 23:12:19 UTC (rev 17515)
@@ -92,9 +92,10 @@
   /* first stage (lossless partitioning) */
   int    grouping;         /* group n vectors per partition */
   int    partitions;       /* possible codebooks for a partition */
+  int    partvals;         /* partitions ^ groupbook dim */
   int    groupbook;        /* huffbook for partitioning */
   int    secondstages[64]; /* expanded out to pointers in lookup */
-  int    booklist[256];    /* list of second stage books */
+  int    booklist[512];    /* list of second stage books */
 } vorbis_info_residue0;
 
 /* Mapping backend generic *****************************************/

Modified: trunk/Tremor/info.c
===================================================================
--- trunk/Tremor/info.c	2010-10-13 20:58:52 UTC (rev 17514)
+++ trunk/Tremor/info.c	2010-10-13 23:12:19 UTC (rev 17515)
@@ -21,6 +21,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
+#include <limits.h>
 #include <ogg/ogg.h>
 #include "ivorbiscodec.h"
 #include "codec_internal.h"
@@ -194,9 +195,9 @@
   if(vc->vendor==NULL)goto err_out;
   _v_readstring(opb,vc->vendor,vendorlen);
   i=oggpack_read(opb,32);
-  if(i<0||i>(opb->storage-oggpack_bytes(opb))>>2)goto err_out;
-  vc->user_comments=(char **)_ogg_calloc(vc->comments+1,sizeof(*vc->user_comments));
-  vc->comment_lengths=(int *)_ogg_calloc(vc->comments+1, sizeof(*vc->comment_lengths));
+  if(i<0||i>=INT_MAX||i>(opb->storage-oggpack_bytes(opb))>>2)goto err_out;
+  vc->user_comments=(char **)_ogg_calloc(i+1,sizeof(*vc->user_comments));
+  vc->comment_lengths=(int *)_ogg_calloc(i+1, sizeof(*vc->comment_lengths));
   if(vc->user_comments==NULL||vc->comment_lengths==NULL)goto err_out;
   vc->comments=i;
 

Modified: trunk/Tremor/iseeking_example.c
===================================================================
--- trunk/Tremor/iseeking_example.c	2010-10-13 20:58:52 UTC (rev 17514)
+++ trunk/Tremor/iseeking_example.c	2010-10-13 23:12:19 UTC (rev 17515)
@@ -18,8 +18,8 @@
 
 #include <stdlib.h>
 #include <stdio.h>
-#include <vorbis/ivorbiscodec.h>
-#include <vorbis/ivorbisfile.h>
+#include "ivorbiscodec.h"
+#include "ivorbisfile.h"
 
 #ifdef _WIN32 /* We need the following two to set stdin/stdout to binary */
 # include <io.h>

Modified: trunk/Tremor/ivorbisfile_example.c
===================================================================
--- trunk/Tremor/ivorbisfile_example.c	2010-10-13 20:58:52 UTC (rev 17514)
+++ trunk/Tremor/ivorbisfile_example.c	2010-10-13 23:12:19 UTC (rev 17515)
@@ -21,8 +21,8 @@
 
 #include <stdio.h>
 #include <stdlib.h>
-#include <vorbis/ivorbiscodec.h>
-#include <vorbis/ivorbisfile.h>
+#include "ivorbiscodec.h"
+#include "ivorbisfile.h"
 
 #ifdef _WIN32 /* We need the following two to set stdin/stdout to binary */
 #include <io.h>

Modified: trunk/Tremor/res012.c
===================================================================
--- trunk/Tremor/res012.c	2010-10-13 20:58:52 UTC (rev 17514)
+++ trunk/Tremor/res012.c	2010-10-13 23:12:19 UTC (rev 17515)
@@ -115,6 +115,10 @@
 
   /* verify the phrasebook is not specifying an impossible or
      inconsistent partitioning scheme. */
+  /* modify the phrasebook ranging check from r16327; an early beta
+     encoder had a bug where it used an oversized phrasebook by
+     accident.  These files should continue to be playable, but don't
+     allow an exploit */
   {
     int entries = ci->book_param[info->groupbook]->entries;
     int dim = ci->book_param[info->groupbook]->dim;
@@ -124,7 +128,7 @@
       if(partvals > entries) goto errout;
       dim--;
     }
-    if(partvals != entries) goto errout;
+    info->partvals = partvals;
   }
 
   return(info);
@@ -168,8 +172,7 @@
     }
   }
 
-  look->partvals=look->parts;
-  for(j=1;j<dim;j++)look->partvals*=look->parts;
+  look->partvals=look->phrasebook->entries;
   look->stages=maxstage;
   look->decodemap=(int **)_ogg_malloc(look->partvals*sizeof(*look->decodemap));
   for(j=0;j<look->partvals;j++){
@@ -222,7 +225,7 @@
 	  /* fetch the partition word for each channel */
 	  for(j=0;j<ch;j++){
 	    int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
-	    if(temp==-1)goto eopbreak;
+	    if(temp==-1 || temp>=info->partvals)goto eopbreak;
 	    partword[j][l]=look->decodemap[temp];
 	    if(partword[j][l]==NULL)goto errout;
 	  }
@@ -304,7 +307,7 @@
 	if(s==0){
 	  /* fetch the partition word */
 	  int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
-	  if(temp==-1)goto eopbreak;
+	  if(temp==-1 || temp>info->partvals)goto eopbreak;
 	  partword[l]=look->decodemap[temp];
 	  if(partword[l]==NULL)goto errout;
 	}

Modified: trunk/Tremor/sharedbook.c
===================================================================
--- trunk/Tremor/sharedbook.c	2010-10-13 20:58:52 UTC (rev 17514)
+++ trunk/Tremor/sharedbook.c	2010-10-13 23:12:19 UTC (rev 17515)
@@ -129,6 +129,7 @@
      but the above tree-gen code doesn't mark that. */
   if(sparsecount != 1){
     for(i=1;i<33;i++)
+      printf("%2li: 0x%08lX\n", i, marker[i] & (0xffffffffUL>>(32-i)));
       if(marker[i] & (0xffffffffUL>>(32-i))){
        _ogg_free(r);
        return(NULL);