diff options
| author | Alexander Strasser <eclipse7@gmx.net> | 2006-02-04 09:59:48 +0000 |
|---|---|---|
| committer | Alexander Strasser <eclipse7@gmx.net> | 2006-02-04 09:59:48 +0000 |
| commit | 536b48b2583d9616e574ca36308b1afb5802246f (patch) | |
| tree | 642c5c9a805a2cf7b8ad19db30a5a2f3c976123c /libavcodec/vorbis.c | |
| parent | 43eb59087bf4c61434dd64e5d14dc9c0741ce9b5 (diff) | |
| download | ffmpeg-536b48b2583d9616e574ca36308b1afb5802246f.tar.gz | |
10l (malloc check with the wrong pointer)
Simplification: I have to reconsider this trees and forest thing...
Also readded and documented the check i had in the beginning and removed
before applying. It avoids a possible div by zero.
Originally committed as revision 4934 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/vorbis.c')
| -rw-r--r-- | libavcodec/vorbis.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/libavcodec/vorbis.c b/libavcodec/vorbis.c index 29206cc881..cf4801ea8a 100644 --- a/libavcodec/vorbis.c +++ b/libavcodec/vorbis.c @@ -545,6 +545,13 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc) { floor_setup->data.t0.rate=get_bits(gb, 16); floor_setup->data.t0.bark_map_size=get_bits(gb, 16); floor_setup->data.t0.amplitude_bits=get_bits(gb, 6); + /* zero would result in a div by zero later * + * 2^0 - 1 == 0 */ + if (floor_setup->data.t0.amplitude_bits == 0) { + av_log(vc->avccontext, AV_LOG_ERROR, + "Floor 0 amplitude bits is 0.\n"); + return 1; + } floor_setup->data.t0.amplitude_offset=get_bits(gb, 8); floor_setup->data.t0.num_books=get_bits(gb, 4)+1; @@ -574,7 +581,7 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc) { floor_setup->data.t0.lsp= av_malloc((floor_setup->data.t0.order+1 + max_codebook_dim) * sizeof(float)); - if(!floor_setup->data.t0.book_list) { return 1; } + if(!floor_setup->data.t0.lsp) { return 1; } } #ifdef V_DEBUG /* debug output parsed headers */ @@ -1067,14 +1074,9 @@ static uint_fast8_t vorbis_floor0_decode(vorbis_context *vc, /* calculate linear floor value */ { - int_fast32_t pow_of_two=2, exponent=vf->amplitude_bits; - if ( vf->amplitude_bits ) { - while ( --exponent ) { pow_of_two <<= 1; } - } - else { pow_of_two=1; } q=exp( ( ( (amplitude*vf->amplitude_offset)/ - ((pow_of_two-1) * sqrt(p+q)) ) + (((1<<vf->amplitude_bits)-1) * sqrt(p+q)) ) - vf->amplitude_offset ) * .11512925f ); } |