-
Notifications
You must be signed in to change notification settings - Fork 29
Description
Hi,
I am wondering if there might exist an integer underflow error:
-
comm_samplescan be an any integer:
speech_tools/speech_class/EST_wave_io.cc
Line 796 in e2dcb2a
if (ts.fread(&comm_samples, sizeof(int), 1) != 1) -
If
lengthis zero, thendata_lengthcan be a negative integer:
speech_tools/speech_class/EST_wave_io.cc
Line 839 in e2dcb2a
data_length = (comm_samples-offset)*comm_channels; -
So
num_samplescan be also a negative integer:
speech_tools/speech_class/EST_wave_io.cc
Line 857 in e2dcb2a
*num_samples = data_length/comm_channels; -
Call to
freadwith the negative integer:
speech_tools/speech_class/EST_wave_io.cc
Line 845 in e2dcb2a
if ((n=ts.fread(file_data,get_word_size(actual_sample_type), -
memcpywith a negative number can be vulnerable:
speech_tools/base_class/EST_Token.cc
Line 407 in e2dcb2a
memcpy(buff,&buffer[pos],items_read*size);
Thanks for your time.