Add further array bounds checks to bark_noise_hybridmp.
Make it clear to local analysis that no out-of-bounds array
accesses are possible here.
Follow-up to CVE-2018-10393 and CVE-2017-14160.
@@ -599,11 +599,11 @@ static void bark_noise_hybridmp(int n,const long *b,
XY[i] = tXY;
}
- for (i = 0, x = 0.f;; i++, x += 1.f) {
+ for (i = 0, x = 0.f; i < n; i++, x += 1.f) {
lo = b[i] >> 16;
hi = b[i] & 0xffff;
- if( lo>=0 ) break;
+ if( lo>=0 || -lo>=n ) break;
if( hi>=n ) break;
tN = N[hi] + N[-lo];
@@ -616,16 +616,16 @@ static void bark_noise_hybridmp(int n,const long *b,
B = tN * tXY - tX * tY;
D = tN * tXX - tX * tX;
R = (A + x * B) / D;
- if (R < 0.f)
- R = 0.f;
+ if (R < 0.f) R = 0.f;
noise[i] = R - offset;
}
- for ( ;; i++, x += 1.f) {
+ for ( ; i < n; i++, x += 1.f) {
lo = b[i] >> 16;
hi = b[i] & 0xffff;
+ if( lo<0 || lo>=n ) break;
if( hi>=n ) break;
tN = N[hi] - N[lo];
@@ -642,6 +642,7 @@ static void bark_noise_hybridmp(int n,const long *b,
noise[i] = R - offset;
}
+
for ( ; i < n; i++, x += 1.f) {
R = (A + x * B) / D;
@@ -652,9 +653,10 @@ static void bark_noise_hybridmp(int n,const long *b,
if (fixed <= 0) return;
- for (i = 0, x = 0.f;; i++, x += 1.f) {
+ for (i = 0, x = 0.f; i < n; i++, x += 1.f) {
hi = i + fixed / 2;
lo = hi - fixed;
+ if ( hi>=n ) break;
if ( lo>=0 ) break;
tN = N[hi] + N[-lo];
@@ -671,11 +673,12 @@ static void bark_noise_hybridmp(int n,const long *b,
if (R - offset < noise[i]) noise[i] = R - offset;
}
- for ( ;; i++, x += 1.f) {
+ for ( ; i < n; i++, x += 1.f) {
hi = i + fixed / 2;
lo = hi - fixed;
if ( hi>=n ) break;
+ if ( lo<0 ) break;
tN = N[hi] - N[lo];
tX = X[hi] - X[lo];
