Mercurial > libavcodec.hg
comparison ac3.c @ 8279:6c2dcc1410bb libavcodec
ac3: detect dba errors and prevent writing past end of array
| author | jbr |
|---|---|
| date | Mon, 08 Dec 2008 03:13:20 +0000 |
| parents | 1a93d3bbe3ee |
| children | 63aba08af550 |
comparison
equal
deleted
inserted
replaced
| 8278:24a49d3fdc3b | 8279:6c2dcc1410bb |
|---|---|
| 78 band_psd[k]=v; | 78 band_psd[k]=v; |
| 79 k++; | 79 k++; |
| 80 } while (end > band_start_tab[k]); | 80 } while (end > band_start_tab[k]); |
| 81 } | 81 } |
| 82 | 82 |
| 83 void ff_ac3_bit_alloc_calc_mask(AC3BitAllocParameters *s, int16_t *band_psd, | 83 int ff_ac3_bit_alloc_calc_mask(AC3BitAllocParameters *s, int16_t *band_psd, |
| 84 int start, int end, int fast_gain, int is_lfe, | 84 int start, int end, int fast_gain, int is_lfe, |
| 85 int dba_mode, int dba_nsegs, uint8_t *dba_offsets, | 85 int dba_mode, int dba_nsegs, uint8_t *dba_offsets, |
| 86 uint8_t *dba_lengths, uint8_t *dba_values, | 86 uint8_t *dba_lengths, uint8_t *dba_values, |
| 87 int16_t *mask) | 87 int16_t *mask) |
| 88 { | 88 { |
| 154 | 154 |
| 155 /* delta bit allocation */ | 155 /* delta bit allocation */ |
| 156 | 156 |
| 157 if (dba_mode == DBA_REUSE || dba_mode == DBA_NEW) { | 157 if (dba_mode == DBA_REUSE || dba_mode == DBA_NEW) { |
| 158 int band, seg, delta; | 158 int band, seg, delta; |
| 159 if (dba_nsegs >= 8) | |
| 160 return -1; | |
| 159 band = 0; | 161 band = 0; |
| 160 for (seg = 0; seg < FFMIN(8, dba_nsegs); seg++) { | 162 for (seg = 0; seg < dba_nsegs; seg++) { |
| 161 band = FFMIN(49, band + dba_offsets[seg]); | 163 band += dba_offsets[seg]; |
| 164 if (band >= 50 || dba_lengths[seg] > 50-band) | |
| 165 return -1; | |
| 162 if (dba_values[seg] >= 4) { | 166 if (dba_values[seg] >= 4) { |
| 163 delta = (dba_values[seg] - 3) << 7; | 167 delta = (dba_values[seg] - 3) << 7; |
| 164 } else { | 168 } else { |
| 165 delta = (dba_values[seg] - 4) << 7; | 169 delta = (dba_values[seg] - 4) << 7; |
| 166 } | 170 } |
| 168 mask[band] += delta; | 172 mask[band] += delta; |
| 169 band++; | 173 band++; |
| 170 } | 174 } |
| 171 } | 175 } |
| 172 } | 176 } |
| 177 return 0; | |
| 173 } | 178 } |
| 174 | 179 |
| 175 void ff_ac3_bit_alloc_calc_bap(int16_t *mask, int16_t *psd, int start, int end, | 180 void ff_ac3_bit_alloc_calc_bap(int16_t *mask, int16_t *psd, int start, int end, |
| 176 int snr_offset, int floor, | 181 int snr_offset, int floor, |
| 177 const uint8_t *bap_tab, uint8_t *bap) | 182 const uint8_t *bap_tab, uint8_t *bap) |