This fix is closely related to the fix for CVE-2014-9028. When that
fix went public Miroslav Lichvar noticed a similar potential problem
spot in the same function and was able to craft a file to trigger a
heap write overflow.
Reported-by : Miroslav Lichvar <mlichvar@redhat.com>
Jan Stary reported that on OpenBSD bash isn't located in /bin/
which means that the test fail. He also noted that there didn't
seem to be anything bash specific in the tests.
This patch takes some suggestions from Jan, plus a few fixes tested
on Debian using the bin/sh provided by bash and dash.
Suggested-by: Jan Stary <hans@stare.cz>
This updates one rather important mention of the copyright year
(the encoding/decoding progress display) and a few in the
documentation. Furthermore, it updates the open bug list
Signed-off-by: Erik de Castro Lopo <erikd@mega-nerd.com>
On Mac OSX, the 'wc -c' command returns a number with leading whitespace
which then results in a syntax error when the shell parser expects a
number when it really has a string containing a number. The easy fix is
to use string interpolation.
Closes: https://sourceforge.net/p/flac/bugs/420/
Reported-by: Mark Harris <mark.hsj@gmail.com>
A file provided by the reporters caused the stream decoder to write to
un-allocated heap space resulting in a segfault. The solution is to
error out (by returning false from read_residual_partitioned_rice_())
instead of trying to continue to decode.
Fixes: CVE-2014-9028
Reported-by: Michele Spagnuolo,
Google Security Team <mikispag@google.com>
Michele Spagnuolo provided a file that initially had frames with two
channels but then had a frame with a single channel. This example
program only supports exactly two channels and previously had
insufficient validation.
Closes: https://sourceforge.net/p/flac/bugs/418/
Reported-by: Michele Spagnuolo,
Google Security Team <mikispag@google.com>
This fixes two problems with handling of out-of-bounds arguments
for the window functions, one of which involving an infinite loop
Signed-off-by: Erik de Castro Lopo <erikd@mega-nerd.com>
The retune of compression levels makes this test fail. This is due
to a few approximations used in the encoder that determine which
LP coefficient should result in the smallest file. Differences are
usually very small, but in my case this resulted in compression
level 6 giving a 3 byte bigger file.
This patch lets the compression test pass even if the a compression
level results in a file that is up to 10 byte larger than the
previous level
Signed-off-by: Erik de Castro Lopo <erikd@mega-nerd.com>
This patch changes a the settings associated with compression
levels 6, 7 and 8. With this patch, -e is no longer used, but
instead apodization functions are added. This should improve
compression with at least 95% of all material while not changing
the speed much. Decoding ways, 6 and 8 stay the same, and 7 is
slowed a bit, which makes it as fast as 8.
Signed-off-by: Erik de Castro Lopo <erikd@mega-nerd.com>
On Windows, decoding flac files is also prone to producing fragmented
files. Avoid fragmentation on NTFS by using Windows specific functions to
tell Windows the size of the file beforehand.
Patch-from: Janne Hyvärinen <cse@sci.fi>
Windows in particular can experience slow encoding speeds on highly
fragmented disks. Using setvbuf to increase the size of the buffer to
10Meg.
This is probably not needed on Linux/Unix, but is very unlikely to
to cause any negative effects.
Patch-from: Janne Hyvärinen <cse@sci.fi>
Erik de Castro Lopo