aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAnssi Hannula <anssi.hannula@iki.fi>2011-01-09 23:01:01 +0000
committerCarl Eugen Hoyos <cehoyos@rainbow.studorg.tuwien.ac.at>2011-01-09 23:01:01 +0000
commit39f4d329081732b24f5ad6ef222736f1453bbad2 (patch)
tree06f0f0a89ac18ad05eda3e838d60e38c82859843
parent94fcbf5f38df6606e444c340fbd63433446c4370 (diff)
downloadffmpeg-39f4d329081732b24f5ad6ef222736f1453bbad2.tar.gz
Fix reading over the end of the allocated buffer.
Patch by Anssi Hannula, anssi d hannula a iki d fi Originally committed as revision 26291 to svn://svn.ffmpeg.org/ffmpeg/trunk
-rw-r--r--libavcodec/dca.c16
1 files changed, 15 insertions, 1 deletions
diff --git a/libavcodec/dca.c b/libavcodec/dca.c
index 868fe2f2b5..eda89aa0f3 100644
--- a/libavcodec/dca.c
+++ b/libavcodec/dca.c
@@ -219,6 +219,8 @@ static const int8_t dca_channel_reorder_nolfe_xch[][9] = {
#define DCA_MAX_FRAME_SIZE 16384
#define DCA_MAX_EXSS_HEADER_SIZE 4096
+#define DCA_BUFFER_PADDING_SIZE 1024
+
/** Bit allocation */
typedef struct {
int offset; ///< code values offset
@@ -315,7 +317,7 @@ typedef struct {
DECLARE_ALIGNED(16, float, samples)[(DCA_PRIM_CHANNELS_MAX+1)*256];
const float *samples_chanptr[DCA_PRIM_CHANNELS_MAX+1];
- uint8_t dca_buffer[DCA_MAX_FRAME_SIZE + DCA_MAX_EXSS_HEADER_SIZE];
+ uint8_t dca_buffer[DCA_MAX_FRAME_SIZE + DCA_MAX_EXSS_HEADER_SIZE + DCA_BUFFER_PADDING_SIZE];
int dca_buffer_size; ///< how much data is in the dca_buffer
const int8_t* channel_order_tab; ///< channel reordering table, lfe and non lfe
@@ -605,6 +607,9 @@ static int dca_subframe_header(DCAContext * s, int base_channel, int block_index
/* Primary audio coding side information */
int j, k;
+ if (get_bits_left(&s->gb) < 0)
+ return -1;
+
if (!base_channel) {
s->subsubframes[s->current_subframe] = get_bits(&s->gb, 2) + 1;
s->partial_samples[s->current_subframe] = get_bits(&s->gb, 3);
@@ -661,6 +666,9 @@ static int dca_subframe_header(DCAContext * s, int base_channel, int block_index
}
}
+ if (get_bits_left(&s->gb) < 0)
+ return -1;
+
for (j = base_channel; j < s->prim_channels; j++) {
const uint32_t *scale_table;
int scale_sum;
@@ -696,6 +704,9 @@ static int dca_subframe_header(DCAContext * s, int base_channel, int block_index
s->joint_huff[j] = get_bits(&s->gb, 3);
}
+ if (get_bits_left(&s->gb) < 0)
+ return -1;
+
/* Scale factors for joint subband coding */
for (j = base_channel; j < s->prim_channels; j++) {
int source_channel;
@@ -1053,6 +1064,9 @@ static int dca_subsubframe(DCAContext * s, int base_channel, int block_index)
quant_step_table = lossy_quant_d;
for (k = base_channel; k < s->prim_channels; k++) {
+ if (get_bits_left(&s->gb) < 0)
+ return -1;
+
for (l = 0; l < s->vq_start_subband[k]; l++) {
int m;