Rietveld Code Review Tool
Help | Bug tracker | Discussion group | Source code | Sign in
(178961)

Side by Side Diff: Modules/audioop.c

Issue 24456: audioop.adpcm2lin Buffer Over-read
Patch Set: Created 4 years ago
Left:
Right:
Use n/p to move between diff chunks; N/P to move between comments. Please Sign in to add in-line comments.
Jump to:
View unified diff | Download patch
« no previous file with comments | « Lib/test/test_audioop.py ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 1
2 /* audioopmodule - Module to detect peak values in arrays */ 2 /* audioopmodule - Module to detect peak values in arrays */
3 3
4 #define PY_SSIZE_T_CLEAN 4 #define PY_SSIZE_T_CLEAN
5 5
6 #include "Python.h" 6 #include "Python.h"
7 7
8 typedef short PyInt16; 8 typedef short PyInt16;
9 9
10 #if defined(__CHAR_UNSIGNED__) 10 #if defined(__CHAR_UNSIGNED__)
(...skipping 1608 matching lines...) Expand 10 before | Expand all | Expand 10 after
1619 { 1619 {
1620 signed char *ncp; 1620 signed char *ncp;
1621 Py_ssize_t i; 1621 Py_ssize_t i;
1622 int step, valpred, delta, 1622 int step, valpred, delta,
1623 index, sign, vpdiff, diff; 1623 index, sign, vpdiff, diff;
1624 PyObject *rv = NULL, *str; 1624 PyObject *rv = NULL, *str;
1625 int outputbuffer = 0, bufferstep; 1625 int outputbuffer = 0, bufferstep;
1626 1626
1627 if (!audioop_check_parameters(fragment->len, width)) 1627 if (!audioop_check_parameters(fragment->len, width))
1628 return NULL; 1628 return NULL;
1629
1630 str = PyBytes_FromStringAndSize(NULL, fragment->len/(width*2));
1631 if (str == NULL)
1632 return NULL;
1633 ncp = (signed char *)PyBytes_AsString(str);
1634 1629
1635 /* Decode state, should have (value, step) */ 1630 /* Decode state, should have (value, step) */
1636 if ( state == Py_None ) { 1631 if ( state == Py_None ) {
1637 /* First time, it seems. Set defaults */ 1632 /* First time, it seems. Set defaults */
1638 valpred = 0; 1633 valpred = 0;
1639 index = 0; 1634 index = 0;
1640 } else if (!PyTuple_Check(state)) { 1635 } else if (!PyTuple_Check(state)) {
1641 PyErr_SetString(PyExc_TypeError, "state must be a tuple or None"); 1636 PyErr_SetString(PyExc_TypeError, "state must be a tuple or None");
1642 goto exit; 1637 return NULL;
1643 } else if (!PyArg_ParseTuple(state, "ii", &valpred, &index)) { 1638 } else if (!PyArg_ParseTuple(state, "ii", &valpred, &index)) {
1644 goto exit; 1639 return NULL;
1640 } else {
1641 if (valpred >= 0x8000 || valpred < -0x8000 ||
1642 (size_t)index >= Py_ARRAY_LENGTH(stepsizeTable)) {
1643 PyErr_SetString(PyExc_ValueError, "bad state");
1644 return NULL;
1645 }
1645 } 1646 }
1647
1648 str = PyBytes_FromStringAndSize(NULL, fragment->len/(width*2));
1649 if (str == NULL)
1650 return NULL;
1651 ncp = (signed char *)PyBytes_AsString(str);
1646 1652
1647 step = stepsizeTable[index]; 1653 step = stepsizeTable[index];
1648 bufferstep = 1; 1654 bufferstep = 1;
1649 1655
1650 for (i = 0; i < fragment->len; i += width) { 1656 for (i = 0; i < fragment->len; i += width) {
1651 int val = GETSAMPLE32(width, fragment->buf, i) >> 16; 1657 int val = GETSAMPLE32(width, fragment->buf, i) >> 16;
1652 1658
1653 /* Step 1 - compute difference with previous value */ 1659 /* Step 1 - compute difference with previous value */
1654 if (val < valpred) { 1660 if (val < valpred) {
1655 diff = valpred - val; 1661 diff = valpred - val;
(...skipping 55 matching lines...) Expand 10 before | Expand all | Expand 10 after
1711 1717
1712 /* Step 6 - Output value */ 1718 /* Step 6 - Output value */
1713 if ( bufferstep ) { 1719 if ( bufferstep ) {
1714 outputbuffer = (delta << 4) & 0xf0; 1720 outputbuffer = (delta << 4) & 0xf0;
1715 } else { 1721 } else {
1716 *ncp++ = (delta & 0x0f) | outputbuffer; 1722 *ncp++ = (delta & 0x0f) | outputbuffer;
1717 } 1723 }
1718 bufferstep = !bufferstep; 1724 bufferstep = !bufferstep;
1719 } 1725 }
1720 rv = Py_BuildValue("(O(ii))", str, valpred, index); 1726 rv = Py_BuildValue("(O(ii))", str, valpred, index);
1721
1722 exit:
1723 Py_DECREF(str); 1727 Py_DECREF(str);
1724 return rv; 1728 return rv;
1725 } 1729 }
1726 1730
1727 /*[clinic input] 1731 /*[clinic input]
1728 audioop.adpcm2lin 1732 audioop.adpcm2lin
1729 1733
1730 fragment: Py_buffer 1734 fragment: Py_buffer
1731 width: int 1735 width: int
1732 state: object 1736 state: object
(...skipping 20 matching lines...) Expand all
1753 /* Decode state, should have (value, step) */ 1757 /* Decode state, should have (value, step) */
1754 if ( state == Py_None ) { 1758 if ( state == Py_None ) {
1755 /* First time, it seems. Set defaults */ 1759 /* First time, it seems. Set defaults */
1756 valpred = 0; 1760 valpred = 0;
1757 index = 0; 1761 index = 0;
1758 } else if (!PyTuple_Check(state)) { 1762 } else if (!PyTuple_Check(state)) {
1759 PyErr_SetString(PyExc_TypeError, "state must be a tuple or None"); 1763 PyErr_SetString(PyExc_TypeError, "state must be a tuple or None");
1760 return NULL; 1764 return NULL;
1761 } else if (!PyArg_ParseTuple(state, "ii", &valpred, &index)) 1765 } else if (!PyArg_ParseTuple(state, "ii", &valpred, &index))
1762 return NULL; 1766 return NULL;
1767 else {
1768 if (valpred >= 0x8000 || valpred < -0x8000 ||
1769 (size_t)index >= Py_ARRAY_LENGTH(stepsizeTable)) {
1770 PyErr_SetString(PyExc_ValueError, "bad state");
1771 return NULL;
1772 }
1773 }
1763 1774
1764 if (fragment->len > (PY_SSIZE_T_MAX/2)/width) { 1775 if (fragment->len > (PY_SSIZE_T_MAX/2)/width) {
1765 PyErr_SetString(PyExc_MemoryError, 1776 PyErr_SetString(PyExc_MemoryError,
1766 "not enough memory for output buffer"); 1777 "not enough memory for output buffer");
1767 return NULL; 1778 return NULL;
1768 } 1779 }
1769 outlen = fragment->len*width*2; 1780 outlen = fragment->len*width*2;
1770 str = PyBytes_FromStringAndSize(NULL, outlen); 1781 str = PyBytes_FromStringAndSize(NULL, outlen);
1771 if (str == NULL) 1782 if (str == NULL)
1772 return NULL; 1783 return NULL;
(...skipping 109 matching lines...) Expand 10 before | Expand all | Expand 10 after
1882 if (m == NULL) 1893 if (m == NULL)
1883 return NULL; 1894 return NULL;
1884 d = PyModule_GetDict(m); 1895 d = PyModule_GetDict(m);
1885 if (d == NULL) 1896 if (d == NULL)
1886 return NULL; 1897 return NULL;
1887 AudioopError = PyErr_NewException("audioop.error", NULL, NULL); 1898 AudioopError = PyErr_NewException("audioop.error", NULL, NULL);
1888 if (AudioopError != NULL) 1899 if (AudioopError != NULL)
1889 PyDict_SetItemString(d,"error",AudioopError); 1900 PyDict_SetItemString(d,"error",AudioopError);
1890 return m; 1901 return m;
1891 } 1902 }
OLDNEW
« no previous file with comments | « Lib/test/test_audioop.py ('k') | no next file » | no next file with comments »

RSS Feeds Recent Issues | This issue
This is Rietveld 894c83f36cb7+