comparison shorten.c @ 3303:68721b62a528 libavcodec

sanity checks, some might have been exploitable ...
author michael
date Sat, 13 May 2006 10:45:26 +0000
parents 04b924f8f5a5
children c8c591fe26f8
comparison
equal deleted inserted replaced
3302:cb356bfc7e22 3303:68721b62a528
104 s->avctx = avctx; 104 s->avctx = avctx;
105 105
106 return 0; 106 return 0;
107 } 107 }
108 108
109 static void allocate_buffers(ShortenContext *s) 109 static int allocate_buffers(ShortenContext *s)
110 { 110 {
111 int i, chan; 111 int i, chan;
112 for (chan=0; chan<s->channels; chan++) { 112 for (chan=0; chan<s->channels; chan++) {
113 if(FFMAX(1, s->nmean) >= UINT_MAX/sizeof(int32_t)){
114 av_log(s->avctx, AV_LOG_ERROR, "nmean too large\n");
115 return -1;
116 }
117 if(s->blocksize + s->nwrap >= UINT_MAX/sizeof(int32_t) || s->blocksize + s->nwrap <= (unsigned)s->nwrap){
118 av_log(s->avctx, AV_LOG_ERROR, "s->blocksize + s->nwrap too large\n");
119 return -1;
120 }
121
113 s->offset[chan] = av_realloc(s->offset[chan], sizeof(int32_t)*FFMAX(1, s->nmean)); 122 s->offset[chan] = av_realloc(s->offset[chan], sizeof(int32_t)*FFMAX(1, s->nmean));
114 123
115 s->decoded[chan] = av_realloc(s->decoded[chan], sizeof(int32_t)*(s->blocksize + s->nwrap)); 124 s->decoded[chan] = av_realloc(s->decoded[chan], sizeof(int32_t)*(s->blocksize + s->nwrap));
116 for (i=0; i<s->nwrap; i++) 125 for (i=0; i<s->nwrap; i++)
117 s->decoded[chan][i] = 0; 126 s->decoded[chan][i] = 0;
118 s->decoded[chan] += s->nwrap; 127 s->decoded[chan] += s->nwrap;
119 128 }
120 } 129 return 0;
121 } 130 }
122 131
123 132
124 static inline unsigned int get_uint(ShortenContext *s, int k) 133 static inline unsigned int get_uint(ShortenContext *s, int k)
125 { 134 {