projects/guix·blob python-team · refs

819 lines · 24.1 KiB

1Copied from Debian.
2
3From: Kurt Roeckx <[email protected]>
4Date: Sun, 28 Jan 2018 19:26:36 +0100
5Subject: Check the size before reading with mad_bit_read
6
7There are various cases where it attemps to read past the end of the buffer
8using mad_bit_read(). Most functions didn't even know the size of the buffer
9they were reading from.
10
11Index: libmad-0.15.1b/bit.c
12===================================================================
13--- libmad-0.15.1b.orig/bit.c
14+++ libmad-0.15.1b/bit.c
15@@ -138,6 +138,9 @@ unsigned long mad_bit_read(struct mad_bi
16 {
17 register unsigned long value;
18
19+ if (len == 0)
20+ return 0;
21+
22 if (bitptr->left == CHAR_BIT)
23 bitptr->cache = *bitptr->byte;
24
25Index: libmad-0.15.1b/frame.c
26===================================================================
27--- libmad-0.15.1b.orig/frame.c
28+++ libmad-0.15.1b/frame.c
29@@ -120,11 +120,18 @@ static
30 int decode_header(struct mad_header *header, struct mad_stream *stream)
31 {
32 unsigned int index;
33+ struct mad_bitptr bufend_ptr;
34
35 header->flags = 0;
36 header->private_bits = 0;
37
38+ mad_bit_init(&bufend_ptr, stream->bufend);
39+
40 /* header() */
41+ if (mad_bit_length(&stream->ptr, &bufend_ptr) < 32) {
42+ stream->error = MAD_ERROR_BUFLEN;
43+ return -1;
44+ }
45
46 /* syncword */
47 mad_bit_skip(&stream->ptr, 11);
48@@ -225,8 +232,13 @@ int decode_header(struct mad_header *hea
49 /* error_check() */
50
51 /* crc_check */
52- if (header->flags & MAD_FLAG_PROTECTION)
53+ if (header->flags & MAD_FLAG_PROTECTION) {
54+ if (mad_bit_length(&stream->ptr, &bufend_ptr) < 16) {
55+ stream->error = MAD_ERROR_BUFLEN;
56+ return -1;
57+ }
58 header->crc_target = mad_bit_read(&stream->ptr, 16);
59+ }
60
61 return 0;
62 }
63@@ -338,7 +350,7 @@ int mad_header_decode(struct mad_header
64 stream->error = MAD_ERROR_BUFLEN;
65 goto fail;
66 }
67- else if (!(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
68+ else if ((end - ptr >= 2) && !(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
69 /* mark point where frame sync word was expected */
70 stream->this_frame = ptr;
71 stream->next_frame = ptr + 1;
72@@ -361,6 +373,8 @@ int mad_header_decode(struct mad_header
73 ptr = mad_bit_nextbyte(&stream->ptr);
74 }
75
76+ stream->error = MAD_ERROR_NONE;
77+
78 /* begin processing */
79 stream->this_frame = ptr;
80 stream->next_frame = ptr + 1; /* possibly bogus sync word */
81@@ -413,7 +427,7 @@ int mad_header_decode(struct mad_header
82 /* check that a valid frame header follows this frame */
83
84 ptr = stream->next_frame;
85- if (!(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
86+ if ((end - ptr >= 2) && !(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
87 ptr = stream->next_frame = stream->this_frame + 1;
88 goto sync;
89 }
90Index: libmad-0.15.1b/layer12.c
91===================================================================
92--- libmad-0.15.1b.orig/layer12.c
93+++ libmad-0.15.1b/layer12.c
94@@ -72,10 +72,18 @@ mad_fixed_t const linear_table[14] = {
95 * DESCRIPTION: decode one requantized Layer I sample from a bitstream
96 */
97 static
98-mad_fixed_t I_sample(struct mad_bitptr *ptr, unsigned int nb)
99+mad_fixed_t I_sample(struct mad_bitptr *ptr, unsigned int nb, struct mad_stream *stream)
100 {
101 mad_fixed_t sample;
102+ struct mad_bitptr frameend_ptr;
103
104+ mad_bit_init(&frameend_ptr, stream->next_frame);
105+
106+ if (mad_bit_length(ptr, &frameend_ptr) < nb) {
107+ stream->error = MAD_ERROR_LOSTSYNC;
108+ stream->sync = 0;
109+ return 0;
110+ }
111 sample = mad_bit_read(ptr, nb);
112
113 /* invert most significant bit, extend sign, then scale to fixed format */
114@@ -106,6 +114,10 @@ int mad_layer_I(struct mad_stream *strea
115 struct mad_header *header = &frame->header;
116 unsigned int nch, bound, ch, s, sb, nb;
117 unsigned char allocation[2][32], scalefactor[2][32];
118+ struct mad_bitptr bufend_ptr, frameend_ptr;
119+
120+ mad_bit_init(&bufend_ptr, stream->bufend);
121+ mad_bit_init(&frameend_ptr, stream->next_frame);
122
123 nch = MAD_NCHANNELS(header);
124
125@@ -118,6 +130,11 @@ int mad_layer_I(struct mad_stream *strea
126 /* check CRC word */
127
128 if (header->flags & MAD_FLAG_PROTECTION) {
129+ if (mad_bit_length(&stream->ptr, &bufend_ptr)
130+ < 4 * (bound * nch + (32 - bound))) {
131+ stream->error = MAD_ERROR_BADCRC;
132+ return -1;
133+ }
134 header->crc_check =
135 mad_bit_crc(stream->ptr, 4 * (bound * nch + (32 - bound)),
136 header->crc_check);
137@@ -133,6 +150,11 @@ int mad_layer_I(struct mad_stream *strea
138
139 for (sb = 0; sb < bound; ++sb) {
140 for (ch = 0; ch < nch; ++ch) {
141+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 4) {
142+ stream->error = MAD_ERROR_LOSTSYNC;
143+ stream->sync = 0;
144+ return -1;
145+ }
146 nb = mad_bit_read(&stream->ptr, 4);
147
148 if (nb == 15) {
149@@ -145,6 +167,11 @@ int mad_layer_I(struct mad_stream *strea
150 }
151
152 for (sb = bound; sb < 32; ++sb) {
153+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 4) {
154+ stream->error = MAD_ERROR_LOSTSYNC;
155+ stream->sync = 0;
156+ return -1;
157+ }
158 nb = mad_bit_read(&stream->ptr, 4);
159
160 if (nb == 15) {
161@@ -161,6 +188,11 @@ int mad_layer_I(struct mad_stream *strea
162 for (sb = 0; sb < 32; ++sb) {
163 for (ch = 0; ch < nch; ++ch) {
164 if (allocation[ch][sb]) {
165+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
166+ stream->error = MAD_ERROR_LOSTSYNC;
167+ stream->sync = 0;
168+ return -1;
169+ }
170 scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
171
172 # if defined(OPT_STRICT)
173@@ -185,8 +217,10 @@ int mad_layer_I(struct mad_stream *strea
174 for (ch = 0; ch < nch; ++ch) {
175 nb = allocation[ch][sb];
176 frame->sbsample[ch][s][sb] = nb ?
177- mad_f_mul(I_sample(&stream->ptr, nb),
178+ mad_f_mul(I_sample(&stream->ptr, nb, stream),
179 sf_table[scalefactor[ch][sb]]) : 0;
180+ if (stream->error != 0)
181+ return -1;
182 }
183 }
184
185@@ -194,7 +228,14 @@ int mad_layer_I(struct mad_stream *strea
186 if ((nb = allocation[0][sb])) {
187 mad_fixed_t sample;
188
189- sample = I_sample(&stream->ptr, nb);
190+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < nb) {
191+ stream->error = MAD_ERROR_LOSTSYNC;
192+ stream->sync = 0;
193+ return -1;
194+ }
195+ sample = I_sample(&stream->ptr, nb, stream);
196+ if (stream->error != 0)
197+ return -1;
198
199 for (ch = 0; ch < nch; ++ch) {
200 frame->sbsample[ch][s][sb] =
201@@ -280,13 +321,21 @@ struct quantclass {
202 static
203 void II_samples(struct mad_bitptr *ptr,
204 struct quantclass const *quantclass,
205- mad_fixed_t output[3])
206+ mad_fixed_t output[3], struct mad_stream *stream)
207 {
208 unsigned int nb, s, sample[3];
209+ struct mad_bitptr frameend_ptr;
210+
211+ mad_bit_init(&frameend_ptr, stream->next_frame);
212
213 if ((nb = quantclass->group)) {
214 unsigned int c, nlevels;
215
216+ if (mad_bit_length(ptr, &frameend_ptr) < quantclass->bits) {
217+ stream->error = MAD_ERROR_LOSTSYNC;
218+ stream->sync = 0;
219+ return;
220+ }
221 /* degrouping */
222 c = mad_bit_read(ptr, quantclass->bits);
223 nlevels = quantclass->nlevels;
224@@ -299,8 +348,14 @@ void II_samples(struct mad_bitptr *ptr,
225 else {
226 nb = quantclass->bits;
227
228- for (s = 0; s < 3; ++s)
229+ for (s = 0; s < 3; ++s) {
230+ if (mad_bit_length(ptr, &frameend_ptr) < nb) {
231+ stream->error = MAD_ERROR_LOSTSYNC;
232+ stream->sync = 0;
233+ return;
234+ }
235 sample[s] = mad_bit_read(ptr, nb);
236+ }
237 }
238
239 for (s = 0; s < 3; ++s) {
240@@ -336,6 +391,9 @@ int mad_layer_II(struct mad_stream *stre
241 unsigned char const *offsets;
242 unsigned char allocation[2][32], scfsi[2][32], scalefactor[2][32][3];
243 mad_fixed_t samples[3];
244+ struct mad_bitptr frameend_ptr;
245+
246+ mad_bit_init(&frameend_ptr, stream->next_frame);
247
248 nch = MAD_NCHANNELS(header);
249
250@@ -402,13 +460,24 @@ int mad_layer_II(struct mad_stream *stre
251 for (sb = 0; sb < bound; ++sb) {
252 nbal = bitalloc_table[offsets[sb]].nbal;
253
254- for (ch = 0; ch < nch; ++ch)
255+ for (ch = 0; ch < nch; ++ch) {
256+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < nbal) {
257+ stream->error = MAD_ERROR_LOSTSYNC;
258+ stream->sync = 0;
259+ return -1;
260+ }
261 allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
262+ }
263 }
264
265 for (sb = bound; sb < sblimit; ++sb) {
266 nbal = bitalloc_table[offsets[sb]].nbal;
267
268+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < nbal) {
269+ stream->error = MAD_ERROR_LOSTSYNC;
270+ stream->sync = 0;
271+ return -1;
272+ }
273 allocation[0][sb] =
274 allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
275 }
276@@ -417,8 +486,14 @@ int mad_layer_II(struct mad_stream *stre
277
278 for (sb = 0; sb < sblimit; ++sb) {
279 for (ch = 0; ch < nch; ++ch) {
280- if (allocation[ch][sb])
281+ if (allocation[ch][sb]) {
282+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 2) {
283+ stream->error = MAD_ERROR_LOSTSYNC;
284+ stream->sync = 0;
285+ return -1;
286+ }
287 scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
288+ }
289 }
290 }
291
292@@ -441,6 +516,11 @@ int mad_layer_II(struct mad_stream *stre
293 for (sb = 0; sb < sblimit; ++sb) {
294 for (ch = 0; ch < nch; ++ch) {
295 if (allocation[ch][sb]) {
296+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
297+ stream->error = MAD_ERROR_LOSTSYNC;
298+ stream->sync = 0;
299+ return -1;
300+ }
301 scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
302
303 switch (scfsi[ch][sb]) {
304@@ -451,11 +531,21 @@ int mad_layer_II(struct mad_stream *stre
305 break;
306
307 case 0:
308+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
309+ stream->error = MAD_ERROR_LOSTSYNC;
310+ stream->sync = 0;
311+ return -1;
312+ }
313 scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
314 /* fall through */
315
316 case 1:
317 case 3:
318+ if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
319+ stream->error = MAD_ERROR_LOSTSYNC;
320+ stream->sync = 0;
321+ return -1;
322+ }
323 scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
324 }
325
326@@ -487,7 +577,9 @@ int mad_layer_II(struct mad_stream *stre
327 if ((index = allocation[ch][sb])) {
328 index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
329
330- II_samples(&stream->ptr, &qc_table[index], samples);
331+ II_samples(&stream->ptr, &qc_table[index], samples, stream);
332+ if (stream->error != 0)
333+ return -1;
334
335 for (s = 0; s < 3; ++s) {
336 frame->sbsample[ch][3 * gr + s][sb] =
337@@ -505,7 +597,9 @@ int mad_layer_II(struct mad_stream *stre
338 if ((index = allocation[0][sb])) {
339 index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
340
341- II_samples(&stream->ptr, &qc_table[index], samples);
342+ II_samples(&stream->ptr, &qc_table[index], samples, stream);
343+ if (stream->error != 0)
344+ return -1;
345
346 for (ch = 0; ch < nch; ++ch) {
347 for (s = 0; s < 3; ++s) {
348Index: libmad-0.15.1b/layer3.c
349===================================================================
350--- libmad-0.15.1b.orig/layer3.c
351+++ libmad-0.15.1b/layer3.c
352@@ -598,7 +598,8 @@ enum mad_error III_sideinfo(struct mad_b
353 static
354 unsigned int III_scalefactors_lsf(struct mad_bitptr *ptr,
355 struct channel *channel,
356- struct channel *gr1ch, int mode_extension)
357+ struct channel *gr1ch, int mode_extension,
358+ unsigned int bits_left, unsigned int *part2_length)
359 {
360 struct mad_bitptr start;
361 unsigned int scalefac_compress, index, slen[4], part, n, i;
362@@ -644,8 +645,12 @@ unsigned int III_scalefactors_lsf(struct
363
364 n = 0;
365 for (part = 0; part < 4; ++part) {
366- for (i = 0; i < nsfb[part]; ++i)
367+ for (i = 0; i < nsfb[part]; ++i) {
368+ if (bits_left < slen[part])
369+ return MAD_ERROR_BADSCFSI;
370 channel->scalefac[n++] = mad_bit_read(ptr, slen[part]);
371+ bits_left -= slen[part];
372+ }
373 }
374
375 while (n < 39)
376@@ -690,7 +695,10 @@ unsigned int III_scalefactors_lsf(struct
377 max = (1 << slen[part]) - 1;
378
379 for (i = 0; i < nsfb[part]; ++i) {
380+ if (bits_left < slen[part])
381+ return MAD_ERROR_BADSCFSI;
382 is_pos = mad_bit_read(ptr, slen[part]);
383+ bits_left -= slen[part];
384
385 channel->scalefac[n] = is_pos;
386 gr1ch->scalefac[n++] = (is_pos == max);
387@@ -703,7 +711,8 @@ unsigned int III_scalefactors_lsf(struct
388 }
389 }
390
391- return mad_bit_length(&start, ptr);
392+ *part2_length = mad_bit_length(&start, ptr);
393+ return MAD_ERROR_NONE;
394 }
395
396 /*
397@@ -712,7 +721,8 @@ unsigned int III_scalefactors_lsf(struct
398 */
399 static
400 unsigned int III_scalefactors(struct mad_bitptr *ptr, struct channel *channel,
401- struct channel const *gr0ch, unsigned int scfsi)
402+ struct channel const *gr0ch, unsigned int scfsi,
403+ unsigned int bits_left, unsigned int *part2_length)
404 {
405 struct mad_bitptr start;
406 unsigned int slen1, slen2, sfbi;
407@@ -728,12 +738,20 @@ unsigned int III_scalefactors(struct mad
408 sfbi = 0;
409
410 nsfb = (channel->flags & mixed_block_flag) ? 8 + 3 * 3 : 6 * 3;
411- while (nsfb--)
412+ while (nsfb--) {
413+ if (bits_left < slen1)
414+ return MAD_ERROR_BADSCFSI;
415 channel->scalefac[sfbi++] = mad_bit_read(ptr, slen1);
416+ bits_left -= slen1;
417+ }
418
419 nsfb = 6 * 3;
420- while (nsfb--)
421+ while (nsfb--) {
422+ if (bits_left < slen2)
423+ return MAD_ERROR_BADSCFSI;
424 channel->scalefac[sfbi++] = mad_bit_read(ptr, slen2);
425+ bits_left -= slen2;
426+ }
427
428 nsfb = 1 * 3;
429 while (nsfb--)
430@@ -745,8 +763,12 @@ unsigned int III_scalefactors(struct mad
431 channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
432 }
433 else {
434- for (sfbi = 0; sfbi < 6; ++sfbi)
435+ for (sfbi = 0; sfbi < 6; ++sfbi) {
436+ if (bits_left < slen1)
437+ return MAD_ERROR_BADSCFSI;
438 channel->scalefac[sfbi] = mad_bit_read(ptr, slen1);
439+ bits_left -= slen1;
440+ }
441 }
442
443 if (scfsi & 0x4) {
444@@ -754,8 +776,12 @@ unsigned int III_scalefactors(struct mad
445 channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
446 }
447 else {
448- for (sfbi = 6; sfbi < 11; ++sfbi)
449+ for (sfbi = 6; sfbi < 11; ++sfbi) {
450+ if (bits_left < slen1)
451+ return MAD_ERROR_BADSCFSI;
452 channel->scalefac[sfbi] = mad_bit_read(ptr, slen1);
453+ bits_left -= slen1;
454+ }
455 }
456
457 if (scfsi & 0x2) {
458@@ -763,8 +789,12 @@ unsigned int III_scalefactors(struct mad
459 channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
460 }
461 else {
462- for (sfbi = 11; sfbi < 16; ++sfbi)
463+ for (sfbi = 11; sfbi < 16; ++sfbi) {
464+ if (bits_left < slen2)
465+ return MAD_ERROR_BADSCFSI;
466 channel->scalefac[sfbi] = mad_bit_read(ptr, slen2);
467+ bits_left -= slen2;
468+ }
469 }
470
471 if (scfsi & 0x1) {
472@@ -772,14 +802,19 @@ unsigned int III_scalefactors(struct mad
473 channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
474 }
475 else {
476- for (sfbi = 16; sfbi < 21; ++sfbi)
477+ for (sfbi = 16; sfbi < 21; ++sfbi) {
478+ if (bits_left < slen2)
479+ return MAD_ERROR_BADSCFSI;
480 channel->scalefac[sfbi] = mad_bit_read(ptr, slen2);
481+ bits_left -= slen2;
482+ }
483 }
484
485 channel->scalefac[21] = 0;
486 }
487
488- return mad_bit_length(&start, ptr);
489+ *part2_length = mad_bit_length(&start, ptr);
490+ return MAD_ERROR_NONE;
491 }
492
493 /*
494@@ -933,19 +968,17 @@ static
495 enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
496 struct channel *channel,
497 unsigned char const *sfbwidth,
498- unsigned int part2_length)
499+ signed int part3_length)
500 {
501 signed int exponents[39], exp;
502 signed int const *expptr;
503 struct mad_bitptr peek;
504- signed int bits_left, cachesz;
505+ signed int bits_left, cachesz, fakebits;
506 register mad_fixed_t *xrptr;
507 mad_fixed_t const *sfbound;
508 register unsigned long bitcache;
509
510- bits_left = (signed) channel->part2_3_length - (signed) part2_length;
511- if (bits_left < 0)
512- return MAD_ERROR_BADPART3LEN;
513+ bits_left = part3_length;
514
515 III_exponents(channel, sfbwidth, exponents);
516
517@@ -956,8 +989,12 @@ enum mad_error III_huffdecode(struct mad
518 cachesz = mad_bit_bitsleft(&peek);
519 cachesz += ((32 - 1 - 24) + (24 - cachesz)) & ~7;
520
521+ if (bits_left < cachesz) {
522+ cachesz = bits_left;
523+ }
524 bitcache = mad_bit_read(&peek, cachesz);
525 bits_left -= cachesz;
526+ fakebits = 0;
527
528 xrptr = &xr[0];
529
530@@ -986,7 +1023,7 @@ enum mad_error III_huffdecode(struct mad
531
532 big_values = channel->big_values;
533
534- while (big_values-- && cachesz + bits_left > 0) {
535+ while (big_values-- && cachesz + bits_left - fakebits > 0) {
536 union huffpair const *pair;
537 unsigned int clumpsz, value;
538 register mad_fixed_t requantized;
539@@ -1023,10 +1060,19 @@ enum mad_error III_huffdecode(struct mad
540 unsigned int bits;
541
542 bits = ((32 - 1 - 21) + (21 - cachesz)) & ~7;
543+ if (bits_left < bits) {
544+ bits = bits_left;
545+ }
546 bitcache = (bitcache << bits) | mad_bit_read(&peek, bits);
547 cachesz += bits;
548 bits_left -= bits;
549 }
550+ if (cachesz < 21) {
551+ unsigned int bits = 21 - cachesz;
552+ bitcache <<= bits;
553+ cachesz += bits;
554+ fakebits += bits;
555+ }
556
557 /* hcod (0..19) */
558
559@@ -1041,6 +1087,8 @@ enum mad_error III_huffdecode(struct mad
560 }
561
562 cachesz -= pair->value.hlen;
563+ if (cachesz < fakebits)
564+ return MAD_ERROR_BADHUFFDATA;
565
566 if (linbits) {
567 /* x (0..14) */
568@@ -1054,10 +1102,15 @@ enum mad_error III_huffdecode(struct mad
569
570 case 15:
571 if (cachesz < linbits + 2) {
572- bitcache = (bitcache << 16) | mad_bit_read(&peek, 16);
573- cachesz += 16;
574- bits_left -= 16;
575+ unsigned int bits = 16;
576+ if (bits_left < 16)
577+ bits = bits_left;
578+ bitcache = (bitcache << bits) | mad_bit_read(&peek, bits);
579+ cachesz += bits;
580+ bits_left -= bits;
581 }
582+ if (cachesz - fakebits < linbits)
583+ return MAD_ERROR_BADHUFFDATA;
584
585 value += MASK(bitcache, cachesz, linbits);
586 cachesz -= linbits;
587@@ -1074,6 +1127,8 @@ enum mad_error III_huffdecode(struct mad
588 }
589
590 x_final:
591+ if (cachesz - fakebits < 1)
592+ return MAD_ERROR_BADHUFFDATA;
593 xrptr[0] = MASK1BIT(bitcache, cachesz--) ?
594 -requantized : requantized;
595 }
596@@ -1089,10 +1144,15 @@ enum mad_error III_huffdecode(struct mad
597
598 case 15:
599 if (cachesz < linbits + 1) {
600- bitcache = (bitcache << 16) | mad_bit_read(&peek, 16);
601- cachesz += 16;
602- bits_left -= 16;
603+ unsigned int bits = 16;
604+ if (bits_left < 16)
605+ bits = bits_left;
606+ bitcache = (bitcache << bits) | mad_bit_read(&peek, bits);
607+ cachesz += bits;
608+ bits_left -= bits;
609 }
610+ if (cachesz - fakebits < linbits)
611+ return MAD_ERROR_BADHUFFDATA;
612
613 value += MASK(bitcache, cachesz, linbits);
614 cachesz -= linbits;
615@@ -1109,6 +1169,8 @@ enum mad_error III_huffdecode(struct mad
616 }
617
618 y_final:
619+ if (cachesz - fakebits < 1)
620+ return MAD_ERROR_BADHUFFDATA;
621 xrptr[1] = MASK1BIT(bitcache, cachesz--) ?
622 -requantized : requantized;
623 }
624@@ -1128,6 +1190,8 @@ enum mad_error III_huffdecode(struct mad
625 requantized = reqcache[value] = III_requantize(value, exp);
626 }
627
628+ if (cachesz - fakebits < 1)
629+ return MAD_ERROR_BADHUFFDATA;
630 xrptr[0] = MASK1BIT(bitcache, cachesz--) ?
631 -requantized : requantized;
632 }
633@@ -1146,6 +1210,8 @@ enum mad_error III_huffdecode(struct mad
634 requantized = reqcache[value] = III_requantize(value, exp);
635 }
636
637+ if (cachesz - fakebits < 1)
638+ return MAD_ERROR_BADHUFFDATA;
639 xrptr[1] = MASK1BIT(bitcache, cachesz--) ?
640 -requantized : requantized;
641 }
642@@ -1155,9 +1221,6 @@ enum mad_error III_huffdecode(struct mad
643 }
644 }
645
646- if (cachesz + bits_left < 0)
647- return MAD_ERROR_BADHUFFDATA; /* big_values overrun */
648-
649 /* count1 */
650 {
651 union huffquad const *table;
652@@ -1167,15 +1230,24 @@ enum mad_error III_huffdecode(struct mad
653
654 requantized = III_requantize(1, exp);
655
656- while (cachesz + bits_left > 0 && xrptr <= &xr[572]) {
657+ while (cachesz + bits_left - fakebits > 0 && xrptr <= &xr[572]) {
658 union huffquad const *quad;
659
660 /* hcod (1..6) */
661
662 if (cachesz < 10) {
663- bitcache = (bitcache << 16) | mad_bit_read(&peek, 16);
664- cachesz += 16;
665- bits_left -= 16;
666+ unsigned int bits = 16;
667+ if (bits_left < 16)
668+ bits = bits_left;
669+ bitcache = (bitcache << bits) | mad_bit_read(&peek, bits);
670+ cachesz += bits;
671+ bits_left -= bits;
672+ }
673+ if (cachesz < 10) {
674+ unsigned int bits = 10 - cachesz;
675+ bitcache <<= bits;
676+ cachesz += bits;
677+ fakebits += bits;
678 }
679
680 quad = &table[MASK(bitcache, cachesz, 4)];
681@@ -1188,6 +1260,11 @@ enum mad_error III_huffdecode(struct mad
682 MASK(bitcache, cachesz, quad->ptr.bits)];
683 }
684
685+ if (cachesz - fakebits < quad->value.hlen + quad->value.v
686+ + quad->value.w + quad->value.x + quad->value.y)
687+ /* We don't have enough bits to read one more entry, consider them
688+ * stuffing bits. */
689+ break;
690 cachesz -= quad->value.hlen;
691
692 if (xrptr == sfbound) {
693@@ -1236,22 +1313,8 @@ enum mad_error III_huffdecode(struct mad
694
695 xrptr += 2;
696 }
697-
698- if (cachesz + bits_left < 0) {
699-# if 0 && defined(DEBUG)
700- fprintf(stderr, "huffman count1 overrun (%d bits)\n",
701- -(cachesz + bits_left));
702-# endif
703-
704- /* technically the bitstream is misformatted, but apparently
705- some encoders are just a bit sloppy with stuffing bits */
706-
707- xrptr -= 4;
708- }
709 }
710
711- assert(-bits_left <= MAD_BUFFER_GUARD * CHAR_BIT);
712-
713 # if 0 && defined(DEBUG)
714 if (bits_left < 0)
715 fprintf(stderr, "read %d bits too many\n", -bits_left);
716@@ -2348,10 +2411,11 @@ void III_freqinver(mad_fixed_t sample[18
717 */
718 static
719 enum mad_error III_decode(struct mad_bitptr *ptr, struct mad_frame *frame,
720- struct sideinfo *si, unsigned int nch)
721+ struct sideinfo *si, unsigned int nch, unsigned int md_len)
722 {
723 struct mad_header *header = &frame->header;
724 unsigned int sfreqi, ngr, gr;
725+ int bits_left = md_len * CHAR_BIT;
726
727 {
728 unsigned int sfreq;
729@@ -2383,6 +2447,7 @@ enum mad_error III_decode(struct mad_bit
730 for (ch = 0; ch < nch; ++ch) {
731 struct channel *channel = &granule->ch[ch];
732 unsigned int part2_length;
733+ unsigned int part3_length;
734
735 sfbwidth[ch] = sfbwidth_table[sfreqi].l;
736 if (channel->block_type == 2) {
737@@ -2391,18 +2456,30 @@ enum mad_error III_decode(struct mad_bit
738 }
739
740 if (header->flags & MAD_FLAG_LSF_EXT) {
741- part2_length = III_scalefactors_lsf(ptr, channel,
742+ error = III_scalefactors_lsf(ptr, channel,
743 ch == 0 ? 0 : &si->gr[1].ch[1],
744- header->mode_extension);
745+ header->mode_extension, bits_left, &part2_length);
746 }
747 else {
748- part2_length = III_scalefactors(ptr, channel, &si->gr[0].ch[ch],
749- gr == 0 ? 0 : si->scfsi[ch]);
750+ error = III_scalefactors(ptr, channel, &si->gr[0].ch[ch],
751+ gr == 0 ? 0 : si->scfsi[ch], bits_left, &part2_length);
752 }
753+ if (error)
754+ return error;
755+
756+ bits_left -= part2_length;
757
758- error = III_huffdecode(ptr, xr[ch], channel, sfbwidth[ch], part2_length);
759+ if (part2_length > channel->part2_3_length)
760+ return MAD_ERROR_BADPART3LEN;
761+
762+ part3_length = channel->part2_3_length - part2_length;
763+ if (part3_length > bits_left)
764+ return MAD_ERROR_BADPART3LEN;
765+
766+ error = III_huffdecode(ptr, xr[ch], channel, sfbwidth[ch], part3_length);
767 if (error)
768 return error;
769+ bits_left -= part3_length;
770 }
771
772 /* joint stereo processing */
773@@ -2519,11 +2596,13 @@ int mad_layer_III(struct mad_stream *str
774 unsigned int nch, priv_bitlen, next_md_begin = 0;
775 unsigned int si_len, data_bitlen, md_len;
776 unsigned int frame_space, frame_used, frame_free;
777- struct mad_bitptr ptr;
778+ struct mad_bitptr ptr, bufend_ptr;
779 struct sideinfo si;
780 enum mad_error error;
781 int result = 0;
782
783+ mad_bit_init(&bufend_ptr, stream->bufend);
784+
785 /* allocate Layer III dynamic structures */
786
787 if (stream->main_data == 0) {
788@@ -2587,14 +2666,15 @@ int mad_layer_III(struct mad_stream *str
789 unsigned long header;
790
791 mad_bit_init(&peek, stream->next_frame);
792+ if (mad_bit_length(&peek, &bufend_ptr) >= 57) {
793+ header = mad_bit_read(&peek, 32);
794+ if ((header & 0xffe60000L) /* syncword | layer */ == 0xffe20000L) {
795+ if (!(header & 0x00010000L)) /* protection_bit */
796+ mad_bit_skip(&peek, 16); /* crc_check */
797
798- header = mad_bit_read(&peek, 32);
799- if ((header & 0xffe60000L) /* syncword | layer */ == 0xffe20000L) {
800- if (!(header & 0x00010000L)) /* protection_bit */
801- mad_bit_skip(&peek, 16); /* crc_check */
802-
803- next_md_begin =
804- mad_bit_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8);
805+ next_md_begin =
806+ mad_bit_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8);
807+ }
808 }
809
810 mad_bit_finish(&peek);
811@@ -2653,7 +2733,7 @@ int mad_layer_III(struct mad_stream *str
812 /* decode main_data */
813
814 if (result == 0) {
815- error = III_decode(&ptr, frame, &si, nch);
816+ error = III_decode(&ptr, frame, &si, nch, md_len);
817 if (error) {
818 stream->error = error;
819 result = -1;