Mercurial > libavcodec.hg
comparison shorten.c @ 3303:68721b62a528 libavcodec
sanity checks, some might have been exploitable ...
author | michael |
---|---|
date | Sat, 13 May 2006 10:45:26 +0000 |
parents | 04b924f8f5a5 |
children | c8c591fe26f8 |
comparison
equal
deleted
inserted
replaced
3302:cb356bfc7e22 | 3303:68721b62a528 |
---|---|
104 s->avctx = avctx; | 104 s->avctx = avctx; |
105 | 105 |
106 return 0; | 106 return 0; |
107 } | 107 } |
108 | 108 |
109 static void allocate_buffers(ShortenContext *s) | 109 static int allocate_buffers(ShortenContext *s) |
110 { | 110 { |
111 int i, chan; | 111 int i, chan; |
112 for (chan=0; chan<s->channels; chan++) { | 112 for (chan=0; chan<s->channels; chan++) { |
113 if(FFMAX(1, s->nmean) >= UINT_MAX/sizeof(int32_t)){ | |
114 av_log(s->avctx, AV_LOG_ERROR, "nmean too large\n"); | |
115 return -1; | |
116 } | |
117 if(s->blocksize + s->nwrap >= UINT_MAX/sizeof(int32_t) || s->blocksize + s->nwrap <= (unsigned)s->nwrap){ | |
118 av_log(s->avctx, AV_LOG_ERROR, "s->blocksize + s->nwrap too large\n"); | |
119 return -1; | |
120 } | |
121 | |
113 s->offset[chan] = av_realloc(s->offset[chan], sizeof(int32_t)*FFMAX(1, s->nmean)); | 122 s->offset[chan] = av_realloc(s->offset[chan], sizeof(int32_t)*FFMAX(1, s->nmean)); |
114 | 123 |
115 s->decoded[chan] = av_realloc(s->decoded[chan], sizeof(int32_t)*(s->blocksize + s->nwrap)); | 124 s->decoded[chan] = av_realloc(s->decoded[chan], sizeof(int32_t)*(s->blocksize + s->nwrap)); |
116 for (i=0; i<s->nwrap; i++) | 125 for (i=0; i<s->nwrap; i++) |
117 s->decoded[chan][i] = 0; | 126 s->decoded[chan][i] = 0; |
118 s->decoded[chan] += s->nwrap; | 127 s->decoded[chan] += s->nwrap; |
119 | 128 } |
120 } | 129 return 0; |
121 } | 130 } |
122 | 131 |
123 | 132 |
124 static inline unsigned int get_uint(ShortenContext *s, int k) | 133 static inline unsigned int get_uint(ShortenContext *s, int k) |
125 { | 134 { |