stb icon indicating copy to clipboard operation
stb copied to clipboard

stb_vorbis: extend Mapping submap_floor and submap_residue.

Open AliceLR opened this issue 2 years ago • 0 comments

The submap arrays in Mapping are size 15, but should be size 16. The number of submap entries is in the range [1,16] and the mux values that these arrays are indexed by are in the range [0,15], as long as they are less than the submap count. Per the Vorbis spec, these ranges are correct, and nothing indicates that submap 15 should be considered invalid.

Also moves Mapping::chan to the front of Mapping to reduce the padding overhead of this struct to what it was before expanding the submap arrays.

Found with clang's UndefinedBehaviorSanitizer. Load any of these fuzz files in an stb_vorbis build with UndefinedBehaviorSanitizer enabled, and errors similar to the following should be generated:

stb_vorbis.c:4128:10: runtime error: index 15 out of bounds for type 'uint8 [15]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior stb_vorbis.c:4128:10 in 
stb_vorbis.c:4129:10: runtime error: index 15 out of bounds for type 'uint8 [15]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior stb_vorbis.c:4129:10 in 
stb_vorbis.c:4130:14: runtime error: index 15 out of bounds for type 'uint8 [15]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior stb_vorbis.c:4130:14 in 
stb_vorbis.c:4131:14: runtime error: index 15 out of bounds for type 'uint8 [15]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior stb_vorbis.c:4131:14 in 

OGG_submap_15.tar.gz

AliceLR avatar Mar 16 '22 03:03 AliceLR