|
 |
9ced7b |
From 953b0b85f8462efeac179341c912617c1bae8d4c Mon Sep 17 00:00:00 2001
|
|
|
9ced7b |
From: Wim Taymans <wtaymans@redhat.com>
|
|
|
9ced7b |
Date: Wed, 25 Mar 2020 13:39:30 +0100
|
|
|
9ced7b |
Subject: [PATCH 1/2] CVE-2019-9232: Fix OOB memory access on fuzzed data
|
|
|
9ced7b |
|
|
|
9ced7b |
vp8_norm table has 256 elements while index to it can be higher on
|
|
|
9ced7b |
fuzzed data. Typecasting it to unsigned char will ensure valid range and
|
|
|
9ced7b |
will trigger proper error later. Also declaring "shift" as unsigned char to
|
|
|
9ced7b |
avoid UB sanitizer warning
|
|
|
9ced7b |
|
|
|
9ced7b |
BUG=b/122373286,b/122373822,b/122371119
|
|
|
9ced7b |
---
|
|
|
9ced7b |
vp8/decoder/dboolhuff.h | 2 +-
|
|
|
9ced7b |
vpx_dsp/bitreader.h | 2 +-
|
|
|
9ced7b |
2 files changed, 2 insertions(+), 2 deletions(-)
|
|
|
9ced7b |
|
|
|
9ced7b |
diff --git a/vp8/decoder/dboolhuff.h b/vp8/decoder/dboolhuff.h
|
|
|
9ced7b |
index 04c027cd7..f3b080509 100644
|
|
|
9ced7b |
--- a/vp8/decoder/dboolhuff.h
|
|
|
9ced7b |
+++ b/vp8/decoder/dboolhuff.h
|
|
|
9ced7b |
@@ -76,7 +76,7 @@ static int vp8dx_decode_bool(BOOL_DECODER *br, int probability) {
|
|
|
9ced7b |
}
|
|
|
9ced7b |
|
|
|
9ced7b |
{
|
|
|
9ced7b |
- register int shift = vp8_norm[range];
|
|
|
9ced7b |
+ register unsigned char shift = vp8_norm[(unsigned char)range];
|
|
|
9ced7b |
range <<= shift;
|
|
|
9ced7b |
value <<= shift;
|
|
|
9ced7b |
count -= shift;
|
|
|
9ced7b |
diff --git a/vpx_dsp/bitreader.h b/vpx_dsp/bitreader.h
|
|
|
9ced7b |
index 6ee2a5863..4b87e986c 100644
|
|
|
9ced7b |
--- a/vpx_dsp/bitreader.h
|
|
|
9ced7b |
+++ b/vpx_dsp/bitreader.h
|
|
|
9ced7b |
@@ -94,7 +94,7 @@ static INLINE int vpx_read(vpx_reader *r, int prob) {
|
|
|
9ced7b |
}
|
|
|
9ced7b |
|
|
|
9ced7b |
{
|
|
|
9ced7b |
- register int shift = vpx_norm[range];
|
|
|
9ced7b |
+ register unsigned char shift = vpx_norm[(unsigned char)range];
|
|
|
9ced7b |
range <<= shift;
|
|
|
9ced7b |
value <<= shift;
|
|
|
9ced7b |
count -= shift;
|
|
|
9ced7b |
--
|
|
|
9ced7b |
2.25.1
|
|
|
9ced7b |
|