diff options
Diffstat (limited to 'libavcodec/alsdec.c')
-rw-r--r-- | libavcodec/alsdec.c | 70 |
1 files changed, 42 insertions, 28 deletions
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 56d7f2f..672fcba 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -2,20 +2,20 @@ * MPEG-4 ALS decoder * Copyright (c) 2009 Thilo Borgmann <thilo.borgmann _at_ googlemail.com> * - * This file is part of Libav. + * This file is part of FFmpeg. * - * Libav is free software; you can redistribute it and/or + * FFmpeg is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * - * Libav is distributed in the hope that it will be useful, + * FFmpeg is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public - * License along with Libav; if not, write to the Free Software + * License along with FFmpeg; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ @@ -394,7 +394,7 @@ static av_cold int read_specific_config(ALSDecContext *ctx) if (get_bits_left(&gb) < 32) return -1; - if (avctx->err_recognition & AV_EF_CRCCHECK) { + if (avctx->err_recognition & (AV_EF_CRCCHECK|AV_EF_CAREFUL)) { ctx->crc_table = av_crc_get_table(AV_CRC_32_IEEE_LE); ctx->crc = 0xFFFFFFFF; ctx->crc_org = ~get_bits_long(&gb, 32); @@ -651,6 +651,11 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) for (k = 1; k < sub_blocks; k++) s[k] = s[k - 1] + decode_rice(gb, 0); } + for (k = 0; k < sub_blocks; k++) + if (s[k] > 32) { + av_log(avctx, AV_LOG_ERROR, "k invalid for rice code.\n"); + return -1; + } if (get_bits1(gb)) *bd->shift_lsbs = get_bits(gb, 4) + 1; @@ -663,6 +668,11 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) int opt_order_length = av_ceil_log2(av_clip((bd->block_length >> 3) - 1, 2, sconf->max_order + 1)); *bd->opt_order = get_bits(gb, opt_order_length); + if (*bd->opt_order > sconf->max_order) { + *bd->opt_order = sconf->max_order; + av_log(avctx, AV_LOG_ERROR, "Predictor order too large!\n"); + return -1; + } } else { *bd->opt_order = sconf->max_order; } @@ -695,6 +705,10 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) int rice_param = parcor_rice_table[sconf->coef_table][k][1]; int offset = parcor_rice_table[sconf->coef_table][k][0]; quant_cof[k] = decode_rice(gb, rice_param) + offset; + if (quant_cof[k] < -64 || quant_cof[k] > 63) { + av_log(avctx, AV_LOG_ERROR, "Quantization coefficient %d is out of range!\n", quant_cof[k]); + return AVERROR_INVALIDDATA; + } } // read coefficients 20 to 126 @@ -727,7 +741,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) bd->ltp_gain[0] = decode_rice(gb, 1) << 3; bd->ltp_gain[1] = decode_rice(gb, 2) << 3; - r = get_unary(gb, 0, 4); + r = get_unary(gb, 0, 3); c = get_bits(gb, 2); bd->ltp_gain[2] = ltp_gain_values[r][c]; @@ -756,7 +770,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) int delta[8]; unsigned int k [8]; unsigned int b = av_clip((av_ceil_log2(bd->block_length) - 3) >> 1, 0, 5); - unsigned int i; + unsigned int i = start; // read most significant bits unsigned int high; @@ -767,14 +781,14 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) current_res = bd->raw_samples + start; - for (sb = 0; sb < sub_blocks; sb++) { + for (sb = 0; sb < sub_blocks; sb++, i = 0) { k [sb] = s[sb] > b ? s[sb] - b : 0; delta[sb] = 5 - s[sb] + k[sb]; - ff_bgmc_decode(gb, sb_length, current_res, + ff_bgmc_decode(gb, sb_length - i, current_res, delta[sb], sx[sb], &high, &low, &value, ctx->bgmc_lut, ctx->bgmc_lut_status); - current_res += sb_length; + current_res += sb_length - i; } ff_bgmc_decode_end(gb); @@ -1011,8 +1025,8 @@ static void zero_remaining(unsigned int b, unsigned int b_max, { unsigned int count = 0; - for (; b < b_max; b++) - count += div_blocks[b]; + while (b < b_max) + count += div_blocks[b++]; if (count) memset(buf, 0, sizeof(*buf) * count); @@ -1118,7 +1132,7 @@ static int decode_blocks(ALSDecContext *ctx, unsigned int ra_frame, // reconstruct joint-stereo blocks if (bd[0].js_blocks) { if (bd[1].js_blocks) - av_log(ctx->avctx, AV_LOG_WARNING, "Invalid channel pair!\n"); + av_log(ctx->avctx, AV_LOG_WARNING, "Invalid channel pair.\n"); for (s = 0; s < div_blocks[b]; s++) bd[0].raw_samples[s] = bd[1].raw_samples[s] - bd[0].raw_samples[s]; @@ -1212,7 +1226,7 @@ static int revert_channel_correlation(ALSDecContext *ctx, ALSBlockData *bd, } if (dep == channels) { - av_log(ctx->avctx, AV_LOG_WARNING, "Invalid channel correlation!\n"); + av_log(ctx->avctx, AV_LOG_WARNING, "Invalid channel correlation.\n"); return -1; } @@ -1367,8 +1381,7 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame) bd.raw_samples = ctx->raw_samples[c] + offset; bd.raw_other = NULL; - read_block(ctx, &bd); - if (read_channel_data(ctx, ctx->chan_data[c], c)) + if (read_block(ctx, &bd) || read_channel_data(ctx, ctx->chan_data[c], c)) return -1; } @@ -1388,7 +1401,8 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame) bd.lpc_cof = ctx->lpc_cof[c]; bd.quant_cof = ctx->quant_cof[c]; bd.raw_samples = ctx->raw_samples[c] + offset; - decode_block(ctx, &bd); + if (decode_block(ctx, &bd)) + return -1; } memset(reverted_channels, 0, avctx->channels * sizeof(*reverted_channels)); @@ -1437,7 +1451,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr, ctx->cur_frame_length = sconf->frame_length; // decode the frame data - if ((invalid_frame = read_frame_data(ctx, ra_frame) < 0)) + if ((invalid_frame = read_frame_data(ctx, ra_frame)) < 0) av_log(ctx->avctx, AV_LOG_WARNING, "Reading frame data failed. Skipping RA unit.\n"); @@ -1467,7 +1481,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr, } // update CRC - if (sconf->crc_enabled && (avctx->err_recognition & AV_EF_CRCCHECK)) { + if (sconf->crc_enabled && (avctx->err_recognition & (AV_EF_CRCCHECK|AV_EF_CAREFUL))) { int swap = HAVE_BIGENDIAN != sconf->msb_first; if (ctx->avctx->bits_per_raw_sample == 24) { @@ -1517,7 +1531,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr, // check CRC sums if this is the last frame if (ctx->cur_frame_length != sconf->frame_length && ctx->crc_org != ctx->crc) { - av_log(avctx, AV_LOG_ERROR, "CRC error.\n"); + av_log(avctx, AV_LOG_ERROR, "CRC error!\n"); } } @@ -1579,12 +1593,12 @@ static av_cold int decode_init(AVCodecContext *avctx) ctx->avctx = avctx; if (!avctx->extradata) { - av_log(avctx, AV_LOG_ERROR, "Missing required ALS extradata.\n"); + av_log(avctx, AV_LOG_ERROR, "Missing required ALS extradata!\n"); return -1; } if (read_specific_config(ctx)) { - av_log(avctx, AV_LOG_ERROR, "Reading ALSSpecificConfig failed.\n"); + av_log(avctx, AV_LOG_ERROR, "Reading ALSSpecificConfig failed!\n"); decode_end(avctx); return -1; } @@ -1630,7 +1644,7 @@ static av_cold int decode_init(AVCodecContext *avctx) if (!ctx->quant_cof || !ctx->lpc_cof || !ctx->quant_cof_buffer || !ctx->lpc_cof_buffer || !ctx->lpc_cof_reversed_buffer) { - av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); + av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed!\n"); return AVERROR(ENOMEM); } @@ -1655,7 +1669,7 @@ static av_cold int decode_init(AVCodecContext *avctx) !ctx->opt_order || !ctx->store_prev_samples || !ctx->use_ltp || !ctx->ltp_lag || !ctx->ltp_gain || !ctx->ltp_gain_buffer) { - av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); + av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed!\n"); decode_end(avctx); return AVERROR(ENOMEM); } @@ -1673,7 +1687,7 @@ static av_cold int decode_init(AVCodecContext *avctx) num_buffers); if (!ctx->chan_data_buffer || !ctx->chan_data || !ctx->reverted_channels) { - av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); + av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed!\n"); decode_end(avctx); return AVERROR(ENOMEM); } @@ -1694,7 +1708,7 @@ static av_cold int decode_init(AVCodecContext *avctx) // allocate previous raw sample buffer if (!ctx->prev_raw_samples || !ctx->raw_buffer|| !ctx->raw_samples) { - av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); + av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed!\n"); decode_end(avctx); return AVERROR(ENOMEM); } @@ -1706,13 +1720,13 @@ static av_cold int decode_init(AVCodecContext *avctx) // allocate crc buffer if (HAVE_BIGENDIAN != sconf->msb_first && sconf->crc_enabled && - (avctx->err_recognition & AV_EF_CRCCHECK)) { + (avctx->err_recognition & (AV_EF_CRCCHECK|AV_EF_CAREFUL))) { ctx->crc_buffer = av_malloc(sizeof(*ctx->crc_buffer) * ctx->cur_frame_length * avctx->channels * av_get_bytes_per_sample(avctx->sample_fmt)); if (!ctx->crc_buffer) { - av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); + av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed!\n"); decode_end(avctx); return AVERROR(ENOMEM); } |