commit a6595e6201064f34d1795be4e8d1412e426b233b
author Mark Harris <mark.hsj@gmail.com> Wed Oct 07 09:21:23 2015 -0400
committer Jean-Marc Valin <jmvalin@jmvalin.ca> Wed Oct 07 09:23:33 2015 -0400
tree 9eebb310c48954aff8c4206f4ae07098ec907b25
parent 7c49ad0c5b1cd5ee830f449a34cc32b469db3cee

Extra safety against NaNs in surround_analysis()

Fix out-of-bounds memory read in multichannel surround analysis
with float input that contains NaNs.  Found by afl-fuzz.

Signed-off-by: Jean-Marc Valin <jmvalin@jmvalin.ca>

src/opus_multistream_encoder.c

diff --git a/src/opus_multistream_encoder.c b/src/opus_multistream_encoder.c
index b55ab7a..aa6a267 100644
--- a/src/opus_multistream_encoder.c
+++ b/src/opus_multistream_encoder.c
@@ -202,7 +202,7 @@
       max = b;
       diff = SUB32(EXTEND32(b),EXTEND32(a));
    }
-   if (diff >= QCONST16(8.f, DB_SHIFT))
+   if (!(diff < QCONST16(8.f, DB_SHIFT)))  /* inverted to catch NaNs */
       return max;
 #ifdef FIXED_POINT
    low = SHR32(diff, DB_SHIFT-1);