mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 00:48:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Issue #24456: Fixed possible buffer over-read in adpcm2lin() and lin2adpcm()

Browse source 
functions of the audioop module.
This commit is contained in:
Serhiy Storchaka 2015-06-28 17:52:09 +03:00
parent 101ff3541c
commit 449e2be12b
3 changed files with 40 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

41
Modules/audioop.c
View file

@ -1615,22 +1615,29 @@ audioop_lin2adpcm_impl(PyModuleDef *module, Py_buffer *fragment, int width, PyOb
if (!audioop_check_parameters(fragment->len, width))
return NULL;
str = PyBytes_FromStringAndSize(NULL, fragment->len/(width*2));
if (str == NULL)
return NULL;
ncp = (signed char *)PyBytes_AsString(str);
/* Decode state, should have (value, step) */
if ( state == Py_None ) {
/* First time, it seems. Set defaults */
valpred = 0;
index = 0;
} else if (!PyTuple_Check(state)) {
PyErr_SetString(PyExc_TypeError, "state must be a tuple or None");
goto exit;
} else if (!PyArg_ParseTuple(state, "ii", &valpred, &index)) {
goto exit;
}
else if (!PyTuple_Check(state)) {
PyErr_SetString(PyExc_TypeError, "state must be a tuple or None");
return NULL;
}
else if (!PyArg_ParseTuple(state, "ii", &valpred, &index)) {
return NULL;
}
else if (valpred >= 0x8000 || valpred < -0x8000 ||
(size_t)index >= Py_ARRAY_LENGTH(stepsizeTable)) {
PyErr_SetString(PyExc_ValueError, "bad state");
return NULL;
}
str = PyBytes_FromStringAndSize(NULL, fragment->len/(width*2));
if (str == NULL)
return NULL;
ncp = (signed char *)PyBytes_AsString(str);
step = stepsizeTable[index];
bufferstep = 1;
@ -1706,8 +1713,6 @@ audioop_lin2adpcm_impl(PyModuleDef *module, Py_buffer *fragment, int width, PyOb
bufferstep = !bufferstep;
}
rv = Py_BuildValue("(O(ii))", str, valpred, index);
exit:
Py_DECREF(str);
return rv;
}
@ -1742,11 +1747,19 @@ audioop_adpcm2lin_impl(PyModuleDef *module, Py_buffer *fragment, int width, PyOb
/* First time, it seems. Set defaults */
valpred = 0;
index = 0;
} else if (!PyTuple_Check(state)) {
}
else if (!PyTuple_Check(state)) {
PyErr_SetString(PyExc_TypeError, "state must be a tuple or None");
return NULL;
} else if (!PyArg_ParseTuple(state, "ii", &valpred, &index))
}
else if (!PyArg_ParseTuple(state, "ii", &valpred, &index)) {
return NULL;
}
else if (valpred >= 0x8000 || valpred < -0x8000 ||
(size_t)index >= Py_ARRAY_LENGTH(stepsizeTable)) {
PyErr_SetString(PyExc_ValueError, "bad state");
return NULL;
}
if (fragment->len > (PY_SSIZE_T_MAX/2)/width) {
PyErr_SetString(PyExc_MemoryError,