comparison ac3dec.c @ 8268:4dd63fc58a87 libavcodec

ac3dec: detect out-of-range exponents
author jbr
date Sat, 06 Dec 2008 15:36:23 +0000
parents 1c4ec499557e
children e7949e116f56
comparison
equal deleted inserted replaced
8267:ebbdbb35a0cf 8268:4dd63fc58a87
370 370
371 /** 371 /**
372 * Decode the grouped exponents according to exponent strategy. 372 * Decode the grouped exponents according to exponent strategy.
373 * reference: Section 7.1.3 Exponent Decoding 373 * reference: Section 7.1.3 Exponent Decoding
374 */ 374 */
375 static void decode_exponents(GetBitContext *gbc, int exp_strategy, int ngrps, 375 static int decode_exponents(GetBitContext *gbc, int exp_strategy, int ngrps,
376 uint8_t absexp, int8_t *dexps) 376 uint8_t absexp, int8_t *dexps)
377 { 377 {
378 int i, j, grp, group_size; 378 int i, j, grp, group_size;
379 int dexp[256]; 379 int dexp[256];
380 int expacc, prevexp; 380 int expacc, prevexp;
389 } 389 }
390 390
391 /* convert to absolute exps and expand groups */ 391 /* convert to absolute exps and expand groups */
392 prevexp = absexp; 392 prevexp = absexp;
393 for(i=0; i<ngrps*3; i++) { 393 for(i=0; i<ngrps*3; i++) {
394 prevexp = av_clip(prevexp + dexp[i]-2, 0, 24); 394 prevexp += dexp[i] - 2;
395 if (prevexp < 0 || prevexp > 24)
396 return -1;
395 for(j=0; j<group_size; j++) { 397 for(j=0; j<group_size; j++) {
396 dexps[(i*group_size)+j] = prevexp; 398 dexps[(i*group_size)+j] = prevexp;
397 } 399 }
398 } 400 }
401 return 0;
399 } 402 }
400 403
401 /** 404 /**
402 * Generate transform coefficients for each coupled channel in the coupling 405 * Generate transform coefficients for each coupled channel in the coupling
403 * range using the coupling coefficients and coupling coordinates. 406 * range using the coupling coefficients and coupling coordinates.
987 990
988 /* decode exponents for each channel */ 991 /* decode exponents for each channel */
989 for (ch = !cpl_in_use; ch <= s->channels; ch++) { 992 for (ch = !cpl_in_use; ch <= s->channels; ch++) {
990 if (s->exp_strategy[blk][ch] != EXP_REUSE) { 993 if (s->exp_strategy[blk][ch] != EXP_REUSE) {
991 s->dexps[ch][0] = get_bits(gbc, 4) << !ch; 994 s->dexps[ch][0] = get_bits(gbc, 4) << !ch;
992 decode_exponents(gbc, s->exp_strategy[blk][ch], 995 if (decode_exponents(gbc, s->exp_strategy[blk][ch],
993 s->num_exp_groups[ch], s->dexps[ch][0], 996 s->num_exp_groups[ch], s->dexps[ch][0],
994 &s->dexps[ch][s->start_freq[ch]+!!ch]); 997 &s->dexps[ch][s->start_freq[ch]+!!ch])) {
998 av_log(s->avctx, AV_LOG_ERROR, "exponent out-of-range\n");
999 return -1;
1000 }
995 if(ch != CPL_CH && ch != s->lfe_ch) 1001 if(ch != CPL_CH && ch != s->lfe_ch)
996 skip_bits(gbc, 2); /* skip gainrng */ 1002 skip_bits(gbc, 2); /* skip gainrng */
997 } 1003 }
998 } 1004 }
999 1005