Commit a79ec216 authored by Guido Günther's avatar Guido Günther Committed by Thomas Daede

CVE-2017-14633: Don't allow for more than 256 channels

Otherwise

 for(i=0;i<vi->channels;i++){
      /* the encoder setup assumes that all the modes used by any
         specific bitrate tweaking use the same floor */
      int submap=info->chmuxlist[i];

overreads later in mapping0_forward since chmuxlist is a fixed array of
256 elements max.
parent c7840572
......@@ -588,7 +588,7 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v,
oggpack_buffer opb;
private_state *b=v->backend_state;
if(!b||vi->channels<=0){
if(!b||vi->channels<=0||vi->channels>256){
ret=OV_EFAULT;
goto err_out;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment