After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 552801 - audioconvert can overflow with big audio buffers
audioconvert can overflow with big audio buffers
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-base
git master
Other Linux
: Normal minor
: 0.10.22
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2008-09-18 17:06 UTC by Antoine Tremblay
Modified: 2008-10-08 11:50 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
Patch to fix the problem (761 bytes, patch)
2008-09-18 17:07 UTC, Antoine Tremblay 		rejected Details | Review

Description Antoine Tremblay 2008-09-18 17:06:02 UTC 
in audio_convert_convert

 intemp = insize * size * 8 / ctx->in.width;
  }
  if (!ctx->mix_passthrough || !ctx->out_default)
    outtemp = outsize * size * 8 / ctx->out.width;

The multiplication of insize/outsize * 32 can overflow 

Fixed by making the multiplication/ division in 64 bits before reconverting in 32... (this is ok since the division will remove the overflow)

See patch below
Comment 1 Antoine Tremblay 2008-09-18 17:07:20 UTC 
Created attachment 118964 [details] [review]
Patch to fix the problem

Original patch by Frederic Giasson
Comment 2 Edward Hervey 2008-09-21 08:50:49 UTC 
using gst_util_uint64_scale* would be even safer.
Comment 3 Antoine Tremblay 2008-09-21 14:42:19 UTC 
Yeah but the values are int , not unsigned int.. unless I change that.. I don't think I can use it ? ,
Comment 4 Sebastian Dröge (slomo) 2008-10-08 11:50:32 UTC 
2008-10-08  Sebastian Dröge  <sebastian.droege@collabora.co.uk>

	* gst/audioconvert/audioconvert.c: (audio_convert_convert):
	Prevent overflows with big buffer when calculating the size of
	the intermediate buffer by using gst_util_uint64_scale() instead of
	plain arithmetics. Fixes bug #552801.