diff --git a/fuzzing_test.go b/fuzzing_test.go index ad600e2..410c3d0 100644 --- a/fuzzing_test.go +++ b/fuzzing_test.go @@ -27,8 +27,9 @@ func (b *bytesReadCloser) Close() error { return nil } -func TestFuzzingIssue3(t *testing.T) { +func TestFuzzing(t *testing.T) { inputs := []string{ + // #3 "\xff\xfa500000000000\xff\xff0000" + "00000000000000000000" + "00000000000000000000" + @@ -75,6 +76,13 @@ func TestFuzzingIssue3(t *testing.T) { "\xee\u007f\xff\xff\u007f\xff\xff\u007f\xff\xff\xfc\xee\xff\xef\xbf0\xef\xbf00" + "0\xff\xee\u007f\xff\xff\u007f\xff\xff\xee\u007f\xff\xff\u007f\xff\xff\u007f\xff0\t" + "\xff\xff\xee\xee", + // #22 + "\xff\xfa%00000000000000000" + + "000000000000s0000000" + + "00000000000000000000" + + "00000000000000000000" + + "00000000000000000000" + + "00000000000000000000", } for _, input := range inputs { b := &bytesReadCloser{bytes.NewReader([]byte(input))} diff --git a/internal/frame/frame.go b/internal/frame/frame.go index 8ee2257..acbfcfc 100644 --- a/internal/frame/frame.go +++ b/internal/frame/frame.go @@ -623,8 +623,9 @@ func (f *Frame) subbandSynthesis(gr int, ch int, out []byte) { // Setup the n_win windowing vector and the v_vec intermediate vector for ss := 0; ss < 18; ss++ { // Loop through 18 samples in 32 subbands copy(f.v_vec[ch][64:1024], f.v_vec[ch][0:1024-64]) + d := f.mainData.Is[gr][ch] for i := 0; i < 32; i++ { // Copy next 32 time samples to a temp vector - s_vec[i] = f.mainData.Is[gr][ch][i*18+ss] + s_vec[i] = d[i*18+ss] } for i := 0; i < 64; i++ { // Matrix multiply input with n_win[][] matrix sum := float32(0) diff --git a/internal/maindata/huffman.go b/internal/maindata/huffman.go index 2179c40..44521d8 100644 --- a/internal/maindata/huffman.go +++ b/internal/maindata/huffman.go @@ -59,6 +59,10 @@ func readHuffman(m *bits.Bits, header frameheader.FrameHeader, sideInfo *sideinf } // Read big_values using tables according to region_x_start for is_pos := 0; is_pos < sideInfo.BigValues[gr][ch]*2; is_pos++ { + // #22 + if is_pos >= len(mainData.Is[gr][ch]) { + return fmt.Errorf("mp3: is_pos was too big: %d", is_pos) + } table_num := 0 if is_pos < region_1_start { table_num = sideInfo.TableSelect[gr][ch][0]