0007-Check-for-multiplication-overflow-in-MSADPCM-decodeS.patch 3.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122
  1. From beacc44eb8cdf6d58717ec1a5103c5141f1b37f9 Mon Sep 17 00:00:00 2001
  2. From: Antonio Larrosa <larrosa@kde.org>
  3. Date: Mon, 6 Mar 2017 13:43:53 +0100
  4. Subject: [PATCH] Check for multiplication overflow in MSADPCM decodeSample
  5. Check for multiplication overflow (using __builtin_mul_overflow
  6. if available) in MSADPCM.cpp decodeSample and return an empty
  7. decoded block if an error occurs.
  8. This fixes the 00193-audiofile-signintoverflow-MSADPCM case of #41
  9. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
  10. ---
  11. libaudiofile/modules/BlockCodec.cpp | 5 ++--
  12. libaudiofile/modules/MSADPCM.cpp | 47 +++++++++++++++++++++++++++++++++----
  13. 2 files changed, 46 insertions(+), 6 deletions(-)
  14. diff --git a/libaudiofile/modules/BlockCodec.cpp b/libaudiofile/modules/BlockCodec.cpp
  15. index 45925e8..4731be1 100644
  16. --- a/libaudiofile/modules/BlockCodec.cpp
  17. +++ b/libaudiofile/modules/BlockCodec.cpp
  18. @@ -52,8 +52,9 @@ void BlockCodec::runPull()
  19. // Decompress into m_outChunk.
  20. for (int i=0; i<blocksRead; i++)
  21. {
  22. - decodeBlock(static_cast<const uint8_t *>(m_inChunk->buffer) + i * m_bytesPerPacket,
  23. - static_cast<int16_t *>(m_outChunk->buffer) + i * m_framesPerPacket * m_track->f.channelCount);
  24. + if (decodeBlock(static_cast<const uint8_t *>(m_inChunk->buffer) + i * m_bytesPerPacket,
  25. + static_cast<int16_t *>(m_outChunk->buffer) + i * m_framesPerPacket * m_track->f.channelCount)==0)
  26. + break;
  27. framesRead += m_framesPerPacket;
  28. }
  29. diff --git a/libaudiofile/modules/MSADPCM.cpp b/libaudiofile/modules/MSADPCM.cpp
  30. index 8ea3c85..ef9c38c 100644
  31. --- a/libaudiofile/modules/MSADPCM.cpp
  32. +++ b/libaudiofile/modules/MSADPCM.cpp
  33. @@ -101,24 +101,60 @@ static const int16_t adaptationTable[] =
  34. 768, 614, 512, 409, 307, 230, 230, 230
  35. };
  36. +int firstBitSet(int x)
  37. +{
  38. + int position=0;
  39. + while (x!=0)
  40. + {
  41. + x>>=1;
  42. + ++position;
  43. + }
  44. + return position;
  45. +}
  46. +
  47. +#ifndef __has_builtin
  48. +#define __has_builtin(x) 0
  49. +#endif
  50. +
  51. +int multiplyCheckOverflow(int a, int b, int *result)
  52. +{
  53. +#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
  54. + return __builtin_mul_overflow(a, b, result);
  55. +#else
  56. + if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
  57. + return true;
  58. + *result = a * b;
  59. + return false;
  60. +#endif
  61. +}
  62. +
  63. +
  64. // Compute a linear PCM value from the given differential coded value.
  65. static int16_t decodeSample(ms_adpcm_state &state,
  66. - uint8_t code, const int16_t *coefficient)
  67. + uint8_t code, const int16_t *coefficient, bool *ok=NULL)
  68. {
  69. int linearSample = (state.sample1 * coefficient[0] +
  70. state.sample2 * coefficient[1]) >> 8;
  71. + int delta;
  72. linearSample += ((code & 0x08) ? (code - 0x10) : code) * state.delta;
  73. linearSample = clamp(linearSample, MIN_INT16, MAX_INT16);
  74. - int delta = (state.delta * adaptationTable[code]) >> 8;
  75. + if (multiplyCheckOverflow(state.delta, adaptationTable[code], &delta))
  76. + {
  77. + if (ok) *ok=false;
  78. + _af_error(AF_BAD_COMPRESSION, "Error decoding sample");
  79. + return 0;
  80. + }
  81. + delta >>= 8;
  82. if (delta < 16)
  83. delta = 16;
  84. state.delta = delta;
  85. state.sample2 = state.sample1;
  86. state.sample1 = linearSample;
  87. + if (ok) *ok=true;
  88. return static_cast<int16_t>(linearSample);
  89. }
  90. @@ -212,13 +248,16 @@ int MSADPCM::decodeBlock(const uint8_t *encoded, int16_t *decoded)
  91. {
  92. uint8_t code;
  93. int16_t newSample;
  94. + bool ok;
  95. code = *encoded >> 4;
  96. - newSample = decodeSample(*state[0], code, coefficient[0]);
  97. + newSample = decodeSample(*state[0], code, coefficient[0], &ok);
  98. + if (!ok) return 0;
  99. *decoded++ = newSample;
  100. code = *encoded & 0x0f;
  101. - newSample = decodeSample(*state[1], code, coefficient[1]);
  102. + newSample = decodeSample(*state[1], code, coefficient[1], &ok);
  103. + if (!ok) return 0;
  104. *decoded++ = newSample;
  105. encoded++;
  106. --
  107. 2.11.0