diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-01-10 17:01:26 -0800 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-02 12:05:08 -0800 |
| commit | 24947d4988012f1f0fd467c83418615adc11c3e8 (patch) | |
| tree | 1fc432286db7a0c4b6397f85013fc6d1dfdb11c8 /libavcodec/vorbisdec.c | |
| parent | 7e4d9d5d456916f51cb40ef646fad5b0a467f4b1 (diff) | |
| download | ffmpeg-24947d4988012f1f0fd467c83418615adc11c3e8.tar.gz | |
vorbis: fix overflows in floor1[] vector and inverse db table index.
Diffstat (limited to 'libavcodec/vorbisdec.c')
| -rw-r--r-- | libavcodec/vorbisdec.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c index 2f1477ffb0..aa4bdff93e 100644 --- a/libavcodec/vorbisdec.c +++ b/libavcodec/vorbisdec.c @@ -1244,20 +1244,20 @@ static int vorbis_floor1_decode(vorbis_context *vc, floor1_flag[i] = 1; if (val >= room) { if (highroom > lowroom) { - floor1_Y_final[i] = val - lowroom + predicted; + floor1_Y_final[i] = av_clip_uint16(val - lowroom + predicted); } else { - floor1_Y_final[i] = predicted - val + highroom - 1; + floor1_Y_final[i] = av_clip_uint16(predicted - val + highroom - 1); } } else { if (val & 1) { - floor1_Y_final[i] = predicted - (val + 1) / 2; + floor1_Y_final[i] = av_clip_uint16(predicted - (val + 1) / 2); } else { - floor1_Y_final[i] = predicted + val / 2; + floor1_Y_final[i] = av_clip_uint16(predicted + val / 2); } } } else { floor1_flag[i] = 0; - floor1_Y_final[i] = predicted; + floor1_Y_final[i] = av_clip_uint16(predicted); } av_dlog(NULL, " Decoded floor(%d) = %u / val %u\n", |