Menu ▾ ▴

#4 SoundTouch crashes in overlap() if offset is negative

v1.0 (example)
closed
nobody
None
5
2017-01-08
2016-12-08
Jamie Bullock
No

In TDStretch.cpp:665 seekBestOverlapPosition() returns offset as an int

This is subsequently cast to a uint in the following call on line 671:

overlap(outputBuffer.ptrEnd((uint)overlapLength), inputBuffer.ptrBegin(), (uint)offset);

Since it is possible for offset to be negative, the value passed to overlap() can be UINT_MAX causing a crash due to reading out of bounds memory in the input vector for one of the overlap() functions

Discussion

  • oparviai

    oparviai - 2016-12-08

    Hello, thanks for the bug report! This issue is fixed in the SVN development repository rev236, please see here:

    https://sourceforge.net/p/soundtouch/code/236/tree/

     

  • Jamie Bullock

    Jamie Bullock - 2016-12-09

    Thanks! I just checkout the latest svn and I confirm that this issue is now fixed for me.

     

  • oparviai

    oparviai - 2017-01-08
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -1,4 +1,3 @@
-
 In TDStretch.cpp:665 `seekBestOverlapPosition()` returns `offset` as an `int`

 This is subsequently cast to a `uint` in the following call on line 671:
    • status: open --> closed
     

Log in to post a comment.

MongoDB Logo MongoDB