accidentally used an oversized phrasebook in res decode; allow these
[technically corrept] files to play. The attack fix is still
watertight, the check is simply made in a different way.
svn path=/trunk/vorbis/; revision=16552
/* first stage (lossless partitioning) */
int grouping; /* group n vectors per partition */
int partitions; /* possible codebooks for a partition */
/* first stage (lossless partitioning) */
int grouping; /* group n vectors per partition */
int partitions; /* possible codebooks for a partition */
+ int partvals; /* partitions ^ groupbook dim */
int groupbook; /* huffbook for partitioning */
int secondstages[64]; /* expanded out to pointers in lookup */
int booklist[512]; /* list of second stage books */
int groupbook; /* huffbook for partitioning */
int secondstages[64]; /* expanded out to pointers in lookup */
int booklist[512]; /* list of second stage books */
/***** residue backends *********************************************/
static const vorbis_info_residue0 _residue_44_low={
/***** residue backends *********************************************/
static const vorbis_info_residue0 _residue_44_low={
/* 0 1 2 3 4 5 6 7 */
{0},
{-1},
/* 0 1 2 3 4 5 6 7 */
{0},
{-1},
};
static const vorbis_info_residue0 _residue_44_mid={
};
static const vorbis_info_residue0 _residue_44_mid={
/* 0 1 2 3 4 5 6 7 8 */
{0},
{-1},
/* 0 1 2 3 4 5 6 7 8 */
{0},
{-1},
};
static const vorbis_info_residue0 _residue_44_high={
};
static const vorbis_info_residue0 _residue_44_high={
/* 0 1 2 3 4 5 6 7 8 */
{0},
{-1},
/* 0 1 2 3 4 5 6 7 8 */
{0},
{-1},
static const vorbis_info_residue0 _residue_44_low_un={
static const vorbis_info_residue0 _residue_44_low_un={
{0},
{-1},
{ .5, 1.5, 1.5, 2.5, 2.5, 4.5, 28.5},
{0},
{-1},
{ .5, 1.5, 1.5, 2.5, 2.5, 4.5, 28.5},
};
static const vorbis_info_residue0 _residue_44_mid_un={
};
static const vorbis_info_residue0 _residue_44_mid_un={
/* 0 1 2 3 4 5 6 7 8 9 */
{0},
{-1},
/* 0 1 2 3 4 5 6 7 8 9 */
{0},
{-1},
};
static const vorbis_info_residue0 _residue_44_hi_un={
};
static const vorbis_info_residue0 _residue_44_hi_un={
/* 0 1 2 3 4 5 6 7 8 9 */
{0},
{-1},
/* 0 1 2 3 4 5 6 7 8 9 */
{0},
{-1},
/* verify the phrasebook is not specifying an impossible or
inconsistent partitioning scheme. */
/* verify the phrasebook is not specifying an impossible or
inconsistent partitioning scheme. */
+ /* modify the phrasebook ranging check from r16327; an early beta
+ encoder had a bug where it used an oversized phrasebook by
+ accident. These files should continue to be playable, but don't
+ allow an exploit */
{
int entries = ci->book_param[info->groupbook]->entries;
int dim = ci->book_param[info->groupbook]->dim;
{
int entries = ci->book_param[info->groupbook]->entries;
int dim = ci->book_param[info->groupbook]->dim;
if(partvals > entries) goto errout;
dim--;
}
if(partvals > entries) goto errout;
dim--;
}
- if(partvals < entries) goto errout;
+ info->partvals = partvals;
for(j=0;j<ch;j++){
int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
for(j=0;j<ch;j++){
int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
- if(temp==-1)goto eopbreak;
+ if(temp==-1 || temp>=info->partvals)goto eopbreak;
partword[j][l]=look->decodemap[temp];
if(partword[j][l]==NULL)goto errout;
}
partword[j][l]=look->decodemap[temp];
if(partword[j][l]==NULL)goto errout;
}
if(s==0){
/* fetch the partition word */
int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
if(s==0){
/* fetch the partition word */
int temp=vorbis_book_decode(look->phrasebook,&vb->opb);
- if(temp==-1)goto eopbreak;
+ if(temp==-1 || temp>info->partvals)goto eopbreak;
partword[l]=look->decodemap[temp];
if(partword[l]==NULL)goto errout;
}
partword[l]=look->decodemap[temp];
if(partword[l]==NULL)goto errout;
}