diff options
author | Justin Ruggles <justin.ruggles@gmail.com> | 2008-12-06 15:36:23 +0000 |
---|---|---|
committer | Justin Ruggles <justin.ruggles@gmail.com> | 2008-12-06 15:36:23 +0000 |
commit | ce7d842fa68db8676807d55c7005b90bff6a9a31 (patch) | |
tree | 0eeedd4421028a73a17de81e9a24aab96f3ff10d /libavcodec/ac3dec.c | |
parent | d8b66635e0927577ae24cd66b1b1d32199bee81f (diff) | |
download | ffmpeg-streaming-ce7d842fa68db8676807d55c7005b90bff6a9a31.zip ffmpeg-streaming-ce7d842fa68db8676807d55c7005b90bff6a9a31.tar.gz |
ac3dec: detect out-of-range exponents
Originally committed as revision 16015 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/ac3dec.c')
-rw-r--r-- | libavcodec/ac3dec.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index 83edfe5..998c872 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -372,7 +372,7 @@ static void set_downmix_coeffs(AC3DecodeContext *s) * Decode the grouped exponents according to exponent strategy. * reference: Section 7.1.3 Exponent Decoding */ -static void decode_exponents(GetBitContext *gbc, int exp_strategy, int ngrps, +static int decode_exponents(GetBitContext *gbc, int exp_strategy, int ngrps, uint8_t absexp, int8_t *dexps) { int i, j, grp, group_size; @@ -391,11 +391,14 @@ static void decode_exponents(GetBitContext *gbc, int exp_strategy, int ngrps, /* convert to absolute exps and expand groups */ prevexp = absexp; for(i=0; i<ngrps*3; i++) { - prevexp = av_clip(prevexp + dexp[i]-2, 0, 24); + prevexp += dexp[i] - 2; + if (prevexp < 0 || prevexp > 24) + return -1; for(j=0; j<group_size; j++) { dexps[(i*group_size)+j] = prevexp; } } + return 0; } /** @@ -989,9 +992,12 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) for (ch = !cpl_in_use; ch <= s->channels; ch++) { if (s->exp_strategy[blk][ch] != EXP_REUSE) { s->dexps[ch][0] = get_bits(gbc, 4) << !ch; - decode_exponents(gbc, s->exp_strategy[blk][ch], + if (decode_exponents(gbc, s->exp_strategy[blk][ch], s->num_exp_groups[ch], s->dexps[ch][0], - &s->dexps[ch][s->start_freq[ch]+!!ch]); + &s->dexps[ch][s->start_freq[ch]+!!ch])) { + av_log(s->avctx, AV_LOG_ERROR, "exponent out-of-range\n"); + return -1; + } if(ch != CPL_CH && ch != s->lfe_ch) skip_bits(gbc, 2); /* skip gainrng */ } |