aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2019-08-04 17:10:18 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2019-08-05 17:54:24 +0200
commit5a5f12e3b3f2177ede5839ff4141228666b8436f (patch)
tree30a3b35f680cd4860f4a992fc43a1864ee2a6c93
parentaecc9b96d613f54d772e9475738bb54e0e1f182e (diff)
downloadffmpeg-5a5f12e3b3f2177ede5839ff4141228666b8436f.tar.gz
avcodec/vorbisdec: Implement vr->classifications = 1
It appears no valid file uses this, so this is not testable with a valid file. Fixes: assertion failure Fixes: 16187/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5638880618872832 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/vorbisdec.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index 793f079737..1045d574b1 100644
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -1361,8 +1361,12 @@ static av_always_inline int setup_classifs(vorbis_context *vc,
return AVERROR_INVALIDDATA;
}
- av_assert0(vr->classifications > 1); //needed for inverse[]
-
+ if (vr->classifications == 1) {
+ for (i = partition_count + c_p_c - 1; i >= partition_count; i--) {
+ if (i < ptns_to_read)
+ vr->classifs[p + i] = 0;
+ }
+ } else {
for (i = partition_count + c_p_c - 1; i >= partition_count; i--) {
temp2 = (((uint64_t)temp) * inverse_class) >> 32;
@@ -1370,6 +1374,7 @@ static av_always_inline int setup_classifs(vorbis_context *vc,
vr->classifs[p + i] = temp - temp2 * vr->classifications;
temp = temp2;
}
+ }
}
p += ptns_to_read;
}