SliTaz Repositories

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/libmad/stuff/patches/frame_length.diff	Thu Apr 09 16:25:22 2020 +0100
     1.3 @@ -0,0 +1,197 @@
     1.4 +; You can calculate where the next frame will start depending on things
     1.5 +; like the bitrate. See mad_header_decode().  It seems that when decoding
     1.6 +; the frame you can go past that boundary.  This attempts to catch those cases,
     1.7 +; but might not catch all of them.
     1.8 +; For more info see http://bugs.debian.org/508133
     1.9 +Index: libmad-0.15.1b/layer12.c
    1.10 +===================================================================
    1.11 +--- libmad-0.15.1b.orig/layer12.c	2008-12-23 21:38:07.000000000 +0100
    1.12 ++++ libmad-0.15.1b/layer12.c	2008-12-23 21:38:12.000000000 +0100
    1.13 +@@ -134,6 +134,12 @@
    1.14 +   for (sb = 0; sb < bound; ++sb) {
    1.15 +     for (ch = 0; ch < nch; ++ch) {
    1.16 +       nb = mad_bit_read(&stream->ptr, 4);
    1.17 ++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
    1.18 ++	{
    1.19 ++		stream->error = MAD_ERROR_LOSTSYNC;
    1.20 ++		stream->sync = 0;
    1.21 ++		return -1;
    1.22 ++	}
    1.23 + 
    1.24 +       if (nb == 15) {
    1.25 + 	stream->error = MAD_ERROR_BADBITALLOC;
    1.26 +@@ -146,6 +152,12 @@
    1.27 + 
    1.28 +   for (sb = bound; sb < 32; ++sb) {
    1.29 +     nb = mad_bit_read(&stream->ptr, 4);
    1.30 ++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
    1.31 ++	{
    1.32 ++		stream->error = MAD_ERROR_LOSTSYNC;
    1.33 ++		stream->sync = 0;
    1.34 ++		return -1;
    1.35 ++	}
    1.36 + 
    1.37 +     if (nb == 15) {
    1.38 +       stream->error = MAD_ERROR_BADBITALLOC;
    1.39 +@@ -162,6 +174,12 @@
    1.40 +     for (ch = 0; ch < nch; ++ch) {
    1.41 +       if (allocation[ch][sb]) {
    1.42 + 	scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
    1.43 ++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
    1.44 ++	{
    1.45 ++		stream->error = MAD_ERROR_LOSTSYNC;
    1.46 ++		stream->sync = 0;
    1.47 ++		return -1;
    1.48 ++	}
    1.49 + 
    1.50 + # if defined(OPT_STRICT)
    1.51 + 	/*
    1.52 +@@ -187,6 +205,12 @@
    1.53 + 	frame->sbsample[ch][s][sb] = nb ?
    1.54 + 	  mad_f_mul(I_sample(&stream->ptr, nb),
    1.55 + 		    sf_table[scalefactor[ch][sb]]) : 0;
    1.56 ++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
    1.57 ++	{
    1.58 ++		stream->error = MAD_ERROR_LOSTSYNC;
    1.59 ++		stream->sync = 0;
    1.60 ++		return -1;
    1.61 ++	}
    1.62 +       }
    1.63 +     }
    1.64 + 
    1.65 +@@ -195,6 +219,12 @@
    1.66 + 	mad_fixed_t sample;
    1.67 + 
    1.68 + 	sample = I_sample(&stream->ptr, nb);
    1.69 ++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
    1.70 ++	{
    1.71 ++		stream->error = MAD_ERROR_LOSTSYNC;
    1.72 ++		stream->sync = 0;
    1.73 ++		return -1;
    1.74 ++	}
    1.75 + 
    1.76 + 	for (ch = 0; ch < nch; ++ch) {
    1.77 + 	  frame->sbsample[ch][s][sb] =
    1.78 +@@ -403,7 +433,15 @@
    1.79 +     nbal = bitalloc_table[offsets[sb]].nbal;
    1.80 + 
    1.81 +     for (ch = 0; ch < nch; ++ch)
    1.82 ++    {
    1.83 +       allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
    1.84 ++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
    1.85 ++	{
    1.86 ++		stream->error = MAD_ERROR_LOSTSYNC;
    1.87 ++		stream->sync = 0;
    1.88 ++		return -1;
    1.89 ++	}
    1.90 ++    }
    1.91 +   }
    1.92 + 
    1.93 +   for (sb = bound; sb < sblimit; ++sb) {
    1.94 +@@ -411,6 +449,13 @@
    1.95 + 
    1.96 +     allocation[0][sb] =
    1.97 +     allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
    1.98 ++
    1.99 ++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
   1.100 ++	{
   1.101 ++		stream->error = MAD_ERROR_LOSTSYNC;
   1.102 ++		stream->sync = 0;
   1.103 ++		return -1;
   1.104 ++	}
   1.105 +   }
   1.106 + 
   1.107 +   /* decode scalefactor selection info */
   1.108 +@@ -419,6 +464,12 @@
   1.109 +     for (ch = 0; ch < nch; ++ch) {
   1.110 +       if (allocation[ch][sb])
   1.111 + 	scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
   1.112 ++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
   1.113 ++	{
   1.114 ++		stream->error = MAD_ERROR_LOSTSYNC;
   1.115 ++		stream->sync = 0;
   1.116 ++		return -1;
   1.117 ++	}
   1.118 +     }
   1.119 +   }
   1.120 + 
   1.121 +@@ -442,6 +493,12 @@
   1.122 +     for (ch = 0; ch < nch; ++ch) {
   1.123 +       if (allocation[ch][sb]) {
   1.124 + 	scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
   1.125 ++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
   1.126 ++	{
   1.127 ++		stream->error = MAD_ERROR_LOSTSYNC;
   1.128 ++		stream->sync = 0;
   1.129 ++		return -1;
   1.130 ++	}
   1.131 + 
   1.132 + 	switch (scfsi[ch][sb]) {
   1.133 + 	case 2:
   1.134 +@@ -452,11 +509,23 @@
   1.135 + 
   1.136 + 	case 0:
   1.137 + 	  scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
   1.138 ++		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
   1.139 ++		{
   1.140 ++			stream->error = MAD_ERROR_LOSTSYNC;
   1.141 ++			stream->sync = 0;
   1.142 ++			return -1;
   1.143 ++		}
   1.144 + 	  /* fall through */
   1.145 + 
   1.146 + 	case 1:
   1.147 + 	case 3:
   1.148 + 	  scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
   1.149 ++		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
   1.150 ++		{
   1.151 ++			stream->error = MAD_ERROR_LOSTSYNC;
   1.152 ++			stream->sync = 0;
   1.153 ++			return -1;
   1.154 ++		}
   1.155 + 	}
   1.156 + 
   1.157 + 	if (scfsi[ch][sb] & 1)
   1.158 +@@ -488,6 +557,12 @@
   1.159 + 	  index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
   1.160 + 
   1.161 + 	  II_samples(&stream->ptr, &qc_table[index], samples);
   1.162 ++		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
   1.163 ++		{
   1.164 ++			stream->error = MAD_ERROR_LOSTSYNC;
   1.165 ++			stream->sync = 0;
   1.166 ++			return -1;
   1.167 ++		}
   1.168 + 
   1.169 + 	  for (s = 0; s < 3; ++s) {
   1.170 + 	    frame->sbsample[ch][3 * gr + s][sb] =
   1.171 +@@ -506,6 +581,12 @@
   1.172 + 	index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
   1.173 + 
   1.174 + 	II_samples(&stream->ptr, &qc_table[index], samples);
   1.175 ++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
   1.176 ++	{
   1.177 ++		stream->error = MAD_ERROR_LOSTSYNC;
   1.178 ++		stream->sync = 0;
   1.179 ++		return -1;
   1.180 ++	}
   1.181 + 
   1.182 + 	for (ch = 0; ch < nch; ++ch) {
   1.183 + 	  for (s = 0; s < 3; ++s) {
   1.184 +Index: libmad-0.15.1b/layer3.c
   1.185 +===================================================================
   1.186 +--- libmad-0.15.1b.orig/layer3.c	2008-12-23 21:38:07.000000000 +0100
   1.187 ++++ libmad-0.15.1b/layer3.c	2008-12-23 21:38:12.000000000 +0100
   1.188 +@@ -2608,6 +2608,12 @@
   1.189 +     next_md_begin = 0;
   1.190 + 
   1.191 +   md_len = si.main_data_begin + frame_space - next_md_begin;
   1.192 ++  if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN)
   1.193 ++  {
   1.194 ++	stream->error = MAD_ERROR_LOSTSYNC;
   1.195 ++	stream->sync = 0;
   1.196 ++	return -1;
   1.197 ++  }
   1.198 + 
   1.199 +   frame_used = 0;
   1.200 +