ref: c3b66186656de44da18b7058aec099dbe782dd0b
parent: 2d64679ffb4bbcff2aa1729797d8c9cbd4219bff
author: Erik de Castro Lopo <erikd@mega-nerd.com>
date: Fri Mar 29 11:54:31 EDT 2013
src/src_sinc.c : Fix a read beyond end of coefficent array problem.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2013-03-29 Erik de Castro Lopo <erikd AT mega-nerd DOT com>
+
+ * src/src_sinc.c
+ Fix a read beyond end of coefficent array problem uncovered by gcc-4.8's
+ -fsanitize=address feature and reported by Cristian Rodríguez.
+
+ Since this is reading filter coefficients from rodata memory and no write
+ is possible, is is not exploitable from a security point of view.
+
+ Solution was to reduce the half_coeff_len value for each filter by one.
+
2013-01-16 Erik de Castro Lopo <erikd AT mega-nerd DOT com>
* src/samplerate.h src/common.h
--- a/src/src_sinc.c
+++ b/src/src_sinc.c
@@ -1,5 +1,5 @@
/*
-** Copyright (C) 2002-2012 Erik de Castro Lopo <erikd@mega-nerd.com>
+** Copyright (C) 2002-2013 Erik de Castro Lopo <erikd@mega-nerd.com>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License as published by
@@ -201,19 +201,19 @@
switch (src_enum)
{ case SRC_SINC_FASTEST :temp_filter.coeffs = fastest_coeffs.coeffs ;
- temp_filter.coeff_half_len = ARRAY_LEN (fastest_coeffs.coeffs) - 1 ;
+ temp_filter.coeff_half_len = ARRAY_LEN (fastest_coeffs.coeffs) - 2 ;
temp_filter.index_inc = fastest_coeffs.increment ;
break ;
case SRC_SINC_MEDIUM_QUALITY :
temp_filter.coeffs = slow_mid_qual_coeffs.coeffs ;
- temp_filter.coeff_half_len = ARRAY_LEN (slow_mid_qual_coeffs.coeffs) - 1 ;
+ temp_filter.coeff_half_len = ARRAY_LEN (slow_mid_qual_coeffs.coeffs) - 2 ;
temp_filter.index_inc = slow_mid_qual_coeffs.increment ;
break ;
case SRC_SINC_BEST_QUALITY :
temp_filter.coeffs = slow_high_qual_coeffs.coeffs ;
- temp_filter.coeff_half_len = ARRAY_LEN (slow_high_qual_coeffs.coeffs) - 1 ;
+ temp_filter.coeff_half_len = ARRAY_LEN (slow_high_qual_coeffs.coeffs) - 2 ;
temp_filter.index_inc = slow_high_qual_coeffs.increment ;
break ;