Mercurial > libavcodec.hg

changeset 8734:bb969c77ad18 libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
check validity of pointer srcC
author stefang
date Tue, 03 Feb 2009 17:56:24 +0000
parents 91007f70b81a
children 5d7ebbb7e91b
files adpcm.c
diffstat 1 files changed, 9 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/adpcm.c	Tue Feb 03 03:01:17 2009 +0000
+++ b/adpcm.c	Tue Feb 03 17:56:24 2009 +0000
@@ -1285,6 +1285,7 @@
         unsigned int channel;
         uint16_t *samplesC;
         const uint8_t *srcC;
+        const uint8_t *src_end = buf + buf_size;
 
         samples_in_chunk = (big_endian ? bytestream_get_be32(&src)
                                        : bytestream_get_le32(&src)) / 28;
@@ -1295,9 +1296,12 @@
         }
 
         for (channel=0; channel<avctx->channels; channel++) {
-            srcC  = src + (avctx->channels-channel) * 4;
-            srcC += (big_endian ? bytestream_get_be32(&src)
-                                : bytestream_get_le32(&src));
+            int32_t offset = (big_endian ? bytestream_get_be32(&src)
+                                         : bytestream_get_le32(&src))
+                           + (avctx->channels-channel-1) * 4;
+
+            if ((offset < 0) || (offset >= src_end - src - 4)) break;
+            srcC  = src + offset;
             samplesC = samples + channel;
 
             if (avctx->codec->id == CODEC_ID_ADPCM_EA_R1) {
@@ -1311,6 +1315,7 @@
             for (count1=0; count1<samples_in_chunk; count1++) {
                 if (*srcC == 0xEE) {  /* only seen in R2 and R3 */
                     srcC++;
+                    if (srcC > src_end - 30*2) break;
                     current_sample  = (int16_t)bytestream_get_be16(&srcC);
                     previous_sample = (int16_t)bytestream_get_be16(&srcC);
 
@@ -1323,6 +1328,7 @@
                     coeff2 = ea_adpcm_table[(*srcC>>4) + 4];
                     shift = (*srcC++ & 0x0F) + 8;
 
+                    if (srcC > src_end - 14) break;
                     for (count2=0; count2<28; count2++) {
                         if (count2 & 1)
                             next_sample = (int32_t)((*srcC++ & 0x0F) << 28) >> shift;