comparison alac.c @ 3303:68721b62a528 libavcodec

sanity checks, some might have been exploitable ...

3302:cb356bfc7e22

    alac->outputsamples_buffer_a = av_malloc(alac->setinfo_max_samples_per_frame * 4);
    alac->outputsamples_buffer_b = av_malloc(alac->setinfo_max_samples_per_frame * 4);
}

static void alac_set_info(ALACContext *alac)
{
    unsigned char *ptr = alac->avctx->extradata;

    ptr += 4; /* size */
    ptr += 4; /* alac */
    ptr += 4; /* 0 ? */

    alac->setinfo_max_samples_per_frame = BE_32(ptr); /* buffer size / 2 ? */
    ptr += 4;
    alac->setinfo_7a = *ptr++;
    alac->setinfo_sample_size = *ptr++;
    alac->setinfo_rice_historymult = *ptr++;

    ptr += 4;
    alac->setinfo_8a_rate = BE_32(ptr); // samplerate
    ptr += 4;

    allocate_buffers(alac);
}

/* hideously inefficient. could use a bitmask search,
 * alternatively bsr on x86,
 */

3303:68721b62a528

    alac->outputsamples_buffer_a = av_malloc(alac->setinfo_max_samples_per_frame * 4);
    alac->outputsamples_buffer_b = av_malloc(alac->setinfo_max_samples_per_frame * 4);
}

static int alac_set_info(ALACContext *alac)
{
    unsigned char *ptr = alac->avctx->extradata;

    ptr += 4; /* size */
    ptr += 4; /* alac */
    ptr += 4; /* 0 ? */

    if(BE_32(ptr) >= UINT_MAX/4){
        av_log(alac->avctx, AV_LOG_ERROR, "setinfo_max_samples_per_frame too large\n");
        return -1;
    }
    alac->setinfo_max_samples_per_frame = BE_32(ptr); /* buffer size / 2 ? */
    ptr += 4;
    alac->setinfo_7a = *ptr++;
    alac->setinfo_sample_size = *ptr++;
    alac->setinfo_rice_historymult = *ptr++;

    ptr += 4;
    alac->setinfo_8a_rate = BE_32(ptr); // samplerate
    ptr += 4;

    allocate_buffers(alac);

    return 0;
}

/* hideously inefficient. could use a bitmask search,
 * alternatively bsr on x86,
 */