aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/qdm2.c
diff options
context:
space:
mode:
authorRonald S. Bultje <rsbultje@gmail.com>2012-05-02 16:12:46 +0000
committerJustin Ruggles <justin.ruggles@gmail.com>2012-05-07 13:08:36 -0400
commit64953f67f98da2e787aeb45cc7f504390fa32a69 (patch)
tree75f1992fc12835c3c92e7f2e6aaeb2d0deb779da /libavcodec/qdm2.c
parent85e5b866dca776ba259113604c56136c2c8531b3 (diff)
downloadffmpeg-64953f67f98da2e787aeb45cc7f504390fa32a69.tar.gz
qdm2: clip array indices returned by qdm2_get_vlc().
Prevents subsequent overreads when these numbers are used as indices in arrays. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
Diffstat (limited to 'libavcodec/qdm2.c')
-rw-r--r--libavcodec/qdm2.c18
1 files changed, 13 insertions, 5 deletions
diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index 54782a24d3..64a821acdc 100644
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -879,9 +879,13 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l
break;
case 30:
- if (get_bits_left(gb) >= 4)
- samples[0] = type30_dequant[qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1)];
- else
+ if (get_bits_left(gb) >= 4) {
+ unsigned index = qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1);
+ if (index < FF_ARRAY_ELEMS(type30_dequant)) {
+ samples[0] = type30_dequant[index];
+ } else
+ samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
+ } else
samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
run = 1;
@@ -895,8 +899,12 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l
type34_predictor = samples[0];
type34_first = 0;
} else {
- samples[0] = type34_delta[qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1)] / type34_div + type34_predictor;
- type34_predictor = samples[0];
+ unsigned index = qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1);
+ if (index < FF_ARRAY_ELEMS(type34_delta)) {
+ samples[0] = type34_delta[index] / type34_div + type34_predictor;
+ type34_predictor = samples[0];
+ } else
+ samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
}
} else {
samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);