libspeex/speex-1.2-CVE-2008-1686.diff

17 lines
637 B
Diff

diff -pruN speex-1.2beta2.orig/libspeex/speex_header.c speex-1.2beta2/libspeex/speex_header.c
--- speex-1.2beta2.orig/libspeex/speex_header.c 2007-03-18 13:25:09.000000000 +0100
+++ speex-1.2beta2/libspeex/speex_header.c 2008-04-15 17:15:18.000000000 +0200
@@ -161,6 +161,13 @@ SpeexHeader *speex_packet_to_header(char
ENDIAN_SWITCH(le_header->frames_per_packet);
ENDIAN_SWITCH(le_header->extra_headers);
+ if (le_header->mode >= SPEEX_NB_MODES || le_header->mode < 0)
+ {
+ speex_warning ("Invalid mode specified in Speex header");
+ speex_free (le_header);
+ return NULL;
+ }
+
return le_header;
}