Re: [FFmpeg-devel] [PATCH 2/5] avcodec/wavpack: Fix overflow in k=31

[Michael Niedermayer <michael@niedermayer.cc>]

[-- Attachment #1.1: Type: text/plain, Size: 1430 bytes --]

On Wed, Nov 30, 2022 at 09:39:44PM +0100, Paul B Mahol wrote:
> On 9/11/22, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > Untested with "non fuzzed" samples as i have no such file
> >
> 
> Then create it.

the official WavPack-5.6.0 decoder has 2 alternative optimized codepathes
#ifdef USE_BITMASK_TABLES
    extras = bitset [bitcount] - maxcode - 1;
#else
    extras = (1 << bitcount) - maxcode - 1;
#endif

The 2nd path would result in the same 1<<32 which is undefined but luckily
the first seems hardcoded to be used it uses this table:

const uint32_t bitset [] = {
    1L << 0, 1L << 1, 1L << 2, 1L << 3,
    1L << 4, 1L << 5, 1L << 6, 1L << 7,
    1L << 8, 1L << 9, 1L << 10, 1L << 11,
    1L << 12, 1L << 13, 1L << 14, 1L << 15,
    1L << 16, 1L << 17, 1L << 18, 1L << 19,
    1L << 20, 1L << 21, 1L << 22, 1L << 23,
    1L << 24, 1L << 25, 1L << 26, 1L << 27,
    1L << 28, 1L << 29, 1L << 30, 1L << 31
};

here bitset[32] is out of array

Given above i suspect no valid file should use this. Otherwise something
seriously odd is going on.

also the subject has a typo its p=31 not k=31

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The real ebay dictionary, page 2
"100% positive feedback" - "All either got their money back or didnt complain"
"Best seller ever, very honest" - "Seller refunded buyer after failed scam"

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".