Re: [SoX-devel] [PATCH] adpcm: fix stack overflow with >4 channels (CVE-2017-15372)

[Eric W. <nor...@yh...>]

Mans Rullgard <ma...@ma...> wrote:
> --- a/src/adpcm.h
> +++ b/src/adpcm.h
> @@ -29,8 +29,11 @@
>  /* default coef sets */
>  extern const short lsx_ms_adpcm_i_coef[7][2];
>  
> +extern void *lsx_ms_adpcm_alloc(unsigned chans);
> +
>  /* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */
>  extern const char *lsx_ms_adpcm_block_expand_i(
> +	void *priv,
>  	unsigned chans,          /* total channels             */
>  	int nCoef,
>  	const short *coef,

Thanks, seems fine; though I'd probably export an opaque struct
which makes the unsigned chans arg redundant.

I'm a little concerned about the internal API changes like this
affecting some 3rd-party code somewhere; but I guess we limit
our exports nowadays (ugh, and that export regexp is nasty)