Mercurial > libavcodec.hg
annotate ac3.c @ 4733:507d08212e36 libavcodec
check input validity, this prevents a few variables from reachin odd values which might have lead to out of array writes and thus might have been exploitable
author | michael |
---|---|
date | Sun, 25 Mar 2007 23:37:38 +0000 |
parents | c7828f1ae244 |
children | 40f3a7f2b1fd |
rev | line source |
---|---|
0 | 1 /* |
4642 | 2 * Common code between AC3 encoder and decoder |
429 | 3 * Copyright (c) 2000 Fabrice Bellard. |
0 | 4 * |
3947
c8c591fe26f8
Change license headers to say 'FFmpeg' instead of 'this program/this library'
diego
parents:
3668
diff
changeset
|
5 * This file is part of FFmpeg. |
c8c591fe26f8
Change license headers to say 'FFmpeg' instead of 'this program/this library'
diego
parents:
3668
diff
changeset
|
6 * |
c8c591fe26f8
Change license headers to say 'FFmpeg' instead of 'this program/this library'
diego
parents:
3668
diff
changeset
|
7 * FFmpeg is free software; you can redistribute it and/or |
429 | 8 * modify it under the terms of the GNU Lesser General Public |
9 * License as published by the Free Software Foundation; either | |
3947
c8c591fe26f8
Change license headers to say 'FFmpeg' instead of 'this program/this library'
diego
parents:
3668
diff
changeset
|
10 * version 2.1 of the License, or (at your option) any later version. |
0 | 11 * |
3947
c8c591fe26f8
Change license headers to say 'FFmpeg' instead of 'this program/this library'
diego
parents:
3668
diff
changeset
|
12 * FFmpeg is distributed in the hope that it will be useful, |
0 | 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of |
429 | 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
15 * Lesser General Public License for more details. | |
0 | 16 * |
429 | 17 * You should have received a copy of the GNU Lesser General Public |
3947
c8c591fe26f8
Change license headers to say 'FFmpeg' instead of 'this program/this library'
diego
parents:
3668
diff
changeset
|
18 * License along with FFmpeg; if not, write to the Free Software |
3036
0b546eab515d
Update licensing information: The FSF changed postal address.
diego
parents:
2979
diff
changeset
|
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA |
0 | 20 */ |
1106 | 21 |
22 /** | |
4642 | 23 * @file ac3.c |
24 * Common code between AC3 encoder and decoder. | |
1106 | 25 */ |
782 | 26 |
4642 | 27 #include "avcodec.h" |
28 #include "ac3.h" | |
0 | 29 #include "ac3tab.h" |
4648 | 30 #include "bitstream.h" |
0 | 31 |
4641 | 32 static inline int calc_lowcomp1(int a, int b0, int b1, int c) |
0 | 33 { |
34 if ((b0 + 256) == b1) { | |
4641 | 35 a = c; |
2967 | 36 } else if (b0 > b1) { |
4641 | 37 a = FFMAX(a - 64, 0); |
0 | 38 } |
39 return a; | |
40 } | |
41 | |
42 static inline int calc_lowcomp(int a, int b0, int b1, int bin) | |
43 { | |
44 if (bin < 7) { | |
4641 | 45 return calc_lowcomp1(a, b0, b1, 384); |
0 | 46 } else if (bin < 20) { |
4641 | 47 return calc_lowcomp1(a, b0, b1, 320); |
0 | 48 } else { |
4641 | 49 return FFMAX(a - 128, 0); |
0 | 50 } |
51 } | |
52 | |
4684
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
53 void ff_ac3_bit_alloc_calc_psd(int8_t *exp, int start, int end, int16_t *psd, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
54 int16_t *bndpsd) |
0 | 55 { |
4684
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
56 int bin, i, j, k, end1, v; |
0 | 57 |
58 /* exponent mapping to PSD */ | |
59 for(bin=start;bin<end;bin++) { | |
60 psd[bin]=(3072 - (exp[bin] << 7)); | |
61 } | |
62 | |
63 /* PSD integration */ | |
64 j=start; | |
65 k=masktab[start]; | |
66 do { | |
67 v=psd[j]; | |
68 j++; | |
4641 | 69 end1 = FFMIN(bndtab[k+1], end); |
0 | 70 for(i=j;i<end1;i++) { |
71 /* logadd */ | |
4641 | 72 int adr = FFMIN(FFABS(v - psd[j]) >> 1, 255); |
73 v = FFMAX(v, psd[j]) + latab[adr]; | |
0 | 74 j++; |
75 } | |
76 bndpsd[k]=v; | |
77 k++; | |
78 } while (end > bndtab[k]); | |
4684
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
79 } |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
80 |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
81 void ff_ac3_bit_alloc_calc_mask(AC3BitAllocParameters *s, int16_t *bndpsd, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
82 int start, int end, int fgain, int is_lfe, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
83 int deltbae, int deltnseg, uint8_t *deltoffst, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
84 uint8_t *deltlen, uint8_t *deltba, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
85 int16_t *mask) |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
86 { |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
87 int16_t excite[50]; /* excitation */ |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
88 int bin, k; |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
89 int bndstrt, bndend, begin, end1, tmp; |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
90 int lowcomp, fastleak, slowleak; |
0 | 91 |
92 /* excitation function */ | |
93 bndstrt = masktab[start]; | |
94 bndend = masktab[end-1] + 1; | |
2967 | 95 |
782 | 96 if (bndstrt == 0) { |
97 lowcomp = 0; | |
4641 | 98 lowcomp = calc_lowcomp1(lowcomp, bndpsd[0], bndpsd[1], 384); |
4640 | 99 excite[0] = bndpsd[0] - fgain - lowcomp; |
4641 | 100 lowcomp = calc_lowcomp1(lowcomp, bndpsd[1], bndpsd[2], 384); |
4640 | 101 excite[1] = bndpsd[1] - fgain - lowcomp; |
102 begin = 7; | |
782 | 103 for (bin = 2; bin < 7; bin++) { |
104 if (!(is_lfe && bin == 6)) | |
4641 | 105 lowcomp = calc_lowcomp1(lowcomp, bndpsd[bin], bndpsd[bin+1], 384); |
4640 | 106 fastleak = bndpsd[bin] - fgain; |
107 slowleak = bndpsd[bin] - s->sgain; | |
108 excite[bin] = fastleak - lowcomp; | |
782 | 109 if (!(is_lfe && bin == 6)) { |
110 if (bndpsd[bin] <= bndpsd[bin+1]) { | |
4640 | 111 begin = bin + 1; |
112 break; | |
782 | 113 } |
114 } | |
115 } | |
2967 | 116 |
782 | 117 end1=bndend; |
118 if (end1 > 22) end1=22; | |
2967 | 119 |
782 | 120 for (bin = begin; bin < end1; bin++) { |
121 if (!(is_lfe && bin == 6)) | |
4640 | 122 lowcomp = calc_lowcomp(lowcomp, bndpsd[bin], bndpsd[bin+1], bin); |
2967 | 123 |
4641 | 124 fastleak = FFMAX(fastleak - s->fdecay, bndpsd[bin] - fgain); |
125 slowleak = FFMAX(slowleak - s->sdecay, bndpsd[bin] - s->sgain); | |
126 excite[bin] = FFMAX(fastleak - lowcomp, slowleak); | |
782 | 127 } |
128 begin = 22; | |
129 } else { | |
130 /* coupling channel */ | |
131 begin = bndstrt; | |
2967 | 132 |
782 | 133 fastleak = (s->cplfleak << 8) + 768; |
134 slowleak = (s->cplsleak << 8) + 768; | |
0 | 135 } |
136 | |
782 | 137 for (bin = begin; bin < bndend; bin++) { |
4641 | 138 fastleak = FFMAX(fastleak - s->fdecay, bndpsd[bin] - fgain); |
139 slowleak = FFMAX(slowleak - s->sdecay, bndpsd[bin] - s->sgain); | |
140 excite[bin] = FFMAX(fastleak, slowleak); | |
0 | 141 } |
142 | |
143 /* compute masking curve */ | |
144 | |
145 for (bin = bndstrt; bin < bndend; bin++) { | |
146 tmp = s->dbknee - bndpsd[bin]; | |
147 if (tmp > 0) { | |
4641 | 148 excite[bin] += tmp >> 2; |
0 | 149 } |
4641 | 150 mask[bin] = FFMAX(hth[bin >> s->halfratecod][s->fscod], excite[bin]); |
0 | 151 } |
152 | |
782 | 153 /* delta bit allocation */ |
154 | |
155 if (deltbae == 0 || deltbae == 1) { | |
156 int band, seg, delta; | |
4640 | 157 band = 0; |
782 | 158 for (seg = 0; seg < deltnseg; seg++) { |
4640 | 159 band += deltoffst[seg]; |
782 | 160 if (deltba[seg] >= 4) { |
161 delta = (deltba[seg] - 3) << 7; | |
162 } else { | |
163 delta = (deltba[seg] - 4) << 7; | |
164 } | |
165 for (k = 0; k < deltlen[seg]; k++) { | |
4640 | 166 mask[band] += delta; |
167 band++; | |
782 | 168 } |
169 } | |
170 } | |
4684
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
171 } |
782 | 172 |
4684
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
173 void ff_ac3_bit_alloc_calc_bap(int16_t *mask, int16_t *psd, int start, int end, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
174 int snroffset, int floor, uint8_t *bap) |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
175 { |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
176 int i, j, k, end1, v, address; |
2967 | 177 |
4689
c7828f1ae244
fix handling of special case for lowest snroffset. regressions are unaffected.
jbr
parents:
4684
diff
changeset
|
178 /* special case, if snroffset is -960, set all bap's to zero */ |
c7828f1ae244
fix handling of special case for lowest snroffset. regressions are unaffected.
jbr
parents:
4684
diff
changeset
|
179 if(snroffset == -960) { |
c7828f1ae244
fix handling of special case for lowest snroffset. regressions are unaffected.
jbr
parents:
4684
diff
changeset
|
180 memset(bap, 0, 256); |
c7828f1ae244
fix handling of special case for lowest snroffset. regressions are unaffected.
jbr
parents:
4684
diff
changeset
|
181 return; |
c7828f1ae244
fix handling of special case for lowest snroffset. regressions are unaffected.
jbr
parents:
4684
diff
changeset
|
182 } |
c7828f1ae244
fix handling of special case for lowest snroffset. regressions are unaffected.
jbr
parents:
4684
diff
changeset
|
183 |
4640 | 184 i = start; |
185 j = masktab[start]; | |
0 | 186 do { |
4684
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
187 v = (FFMAX(mask[j] - snroffset - floor, 0) & 0x1FE0) + floor; |
4641 | 188 end1 = FFMIN(bndtab[j] + bndsz[j], end); |
0 | 189 for (k = i; k < end1; k++) { |
4641 | 190 address = av_clip((psd[i] - v) >> 5, 0, 63); |
0 | 191 bap[i] = baptab[address]; |
192 i++; | |
193 } | |
4640 | 194 } while (end > bndtab[j++]); |
0 | 195 } |
196 | |
4684
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
197 /* AC3 bit allocation. The algorithm is the one described in the AC3 |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
198 spec. */ |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
199 void ac3_parametric_bit_allocation(AC3BitAllocParameters *s, uint8_t *bap, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
200 int8_t *exp, int start, int end, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
201 int snroffset, int fgain, int is_lfe, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
202 int deltbae,int deltnseg, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
203 uint8_t *deltoffst, uint8_t *deltlen, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
204 uint8_t *deltba) |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
205 { |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
206 int16_t psd[256]; /* scaled exponents */ |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
207 int16_t bndpsd[50]; /* interpolated exponents */ |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
208 int16_t mask[50]; /* masking value */ |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
209 |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
210 ff_ac3_bit_alloc_calc_psd(exp, start, end, psd, bndpsd); |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
211 |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
212 ff_ac3_bit_alloc_calc_mask(s, bndpsd, start, end, fgain, is_lfe, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
213 deltbae, deltnseg, deltoffst, deltlen, deltba, |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
214 mask); |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
215 |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
216 ff_ac3_bit_alloc_calc_bap(mask, psd, start, end, snroffset, s->floor, bap); |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
217 } |
6ec0afffc572
split ac3_parametric_bit_allocation into 3 separate functions
jbr
parents:
4679
diff
changeset
|
218 |
4645
056127e5df89
remove redundancy in AC-3 parser by using common tables from ac3tab.h
jbr
parents:
4642
diff
changeset
|
219 /** |
056127e5df89
remove redundancy in AC-3 parser by using common tables from ac3tab.h
jbr
parents:
4642
diff
changeset
|
220 * Initializes some tables. |
056127e5df89
remove redundancy in AC-3 parser by using common tables from ac3tab.h
jbr
parents:
4642
diff
changeset
|
221 * note: This function must remain thread safe because it is called by the |
056127e5df89
remove redundancy in AC-3 parser by using common tables from ac3tab.h
jbr
parents:
4642
diff
changeset
|
222 * AVParser init code. |
056127e5df89
remove redundancy in AC-3 parser by using common tables from ac3tab.h
jbr
parents:
4642
diff
changeset
|
223 */ |
4197 | 224 void ac3_common_init(void) |
782 | 225 { |
226 int i, j, k, l, v; | |
227 /* compute bndtab and masktab from bandsz */ | |
228 k = 0; | |
229 l = 0; | |
230 for(i=0;i<50;i++) { | |
231 bndtab[i] = l; | |
232 v = bndsz[i]; | |
233 for(j=0;j<v;j++) masktab[k++]=i; | |
234 l += v; | |
235 } | |
3668
34d76180e5d0
Fix 2 bit allocation bugs. One fix enables using a higher bandwidth code. The other fixes an issue with floorcod=7.
jbr
parents:
3280
diff
changeset
|
236 bndtab[50] = l; |
782 | 237 } |
4648 | 238 |
239 int ff_ac3_parse_header(const uint8_t buf[7], AC3HeaderInfo *hdr) | |
240 { | |
241 GetBitContext gbc; | |
242 | |
243 memset(hdr, 0, sizeof(*hdr)); | |
244 | |
245 init_get_bits(&gbc, buf, 54); | |
246 | |
247 hdr->sync_word = get_bits(&gbc, 16); | |
248 if(hdr->sync_word != 0x0B77) | |
249 return -1; | |
250 | |
251 /* read ahead to bsid to make sure this is AC-3, not E-AC-3 */ | |
252 hdr->bsid = show_bits_long(&gbc, 29) & 0x1F; | |
253 if(hdr->bsid > 10) | |
254 return -2; | |
255 | |
256 hdr->crc1 = get_bits(&gbc, 16); | |
257 hdr->fscod = get_bits(&gbc, 2); | |
258 if(hdr->fscod == 3) | |
259 return -3; | |
260 | |
261 hdr->frmsizecod = get_bits(&gbc, 6); | |
262 if(hdr->frmsizecod > 37) | |
263 return -4; | |
264 | |
265 skip_bits(&gbc, 5); // skip bsid, already got it | |
266 | |
267 hdr->bsmod = get_bits(&gbc, 3); | |
268 hdr->acmod = get_bits(&gbc, 3); | |
269 if((hdr->acmod & 1) && hdr->acmod != 1) { | |
270 hdr->cmixlev = get_bits(&gbc, 2); | |
271 } | |
272 if(hdr->acmod & 4) { | |
273 hdr->surmixlev = get_bits(&gbc, 2); | |
274 } | |
275 if(hdr->acmod == 2) { | |
276 hdr->dsurmod = get_bits(&gbc, 2); | |
277 } | |
278 hdr->lfeon = get_bits1(&gbc); | |
279 | |
280 hdr->halfratecod = FFMAX(hdr->bsid, 8) - 8; | |
281 hdr->sample_rate = ff_ac3_freqs[hdr->fscod] >> hdr->halfratecod; | |
282 hdr->bit_rate = (ff_ac3_bitratetab[hdr->frmsizecod>>1] * 1000) >> hdr->halfratecod; | |
283 hdr->channels = ff_ac3_channels[hdr->acmod] + hdr->lfeon; | |
284 hdr->frame_size = ff_ac3_frame_sizes[hdr->frmsizecod][hdr->fscod] * 2; | |
285 | |
286 return 0; | |
287 } |