mirror of https://git.ffmpeg.org/ffmpeg.git
ac3: Do not read past the end of ff_ac3_band_start_tab.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Alex Converse <alex.converse@gmail.com>
This commit is contained in:
parent
2d1c0dea5f
commit
034b03e7a0
|
@ -108,7 +108,7 @@ static void ac3_bit_alloc_calc_bap_c(int16_t *mask, int16_t *psd,
|
||||||
int snr_offset, int floor,
|
int snr_offset, int floor,
|
||||||
const uint8_t *bap_tab, uint8_t *bap)
|
const uint8_t *bap_tab, uint8_t *bap)
|
||||||
{
|
{
|
||||||
int bin, band;
|
int bin, band, band_end;
|
||||||
|
|
||||||
/* special case, if snr offset is -960, set all bap's to zero */
|
/* special case, if snr offset is -960, set all bap's to zero */
|
||||||
if (snr_offset == -960) {
|
if (snr_offset == -960) {
|
||||||
|
@ -120,12 +120,14 @@ static void ac3_bit_alloc_calc_bap_c(int16_t *mask, int16_t *psd,
|
||||||
band = ff_ac3_bin_to_band_tab[start];
|
band = ff_ac3_bin_to_band_tab[start];
|
||||||
do {
|
do {
|
||||||
int m = (FFMAX(mask[band] - snr_offset - floor, 0) & 0x1FE0) + floor;
|
int m = (FFMAX(mask[band] - snr_offset - floor, 0) & 0x1FE0) + floor;
|
||||||
int band_end = FFMIN(ff_ac3_band_start_tab[band+1], end);
|
band_end = ff_ac3_band_start_tab[++band];
|
||||||
|
band_end = FFMIN(band_end, end);
|
||||||
|
|
||||||
for (; bin < band_end; bin++) {
|
for (; bin < band_end; bin++) {
|
||||||
int address = av_clip((psd[bin] - m) >> 5, 0, 63);
|
int address = av_clip((psd[bin] - m) >> 5, 0, 63);
|
||||||
bap[bin] = bap_tab[address];
|
bap[bin] = bap_tab[address];
|
||||||
}
|
}
|
||||||
} while (end > ff_ac3_band_start_tab[band++]);
|
} while (end > band_end);
|
||||||
}
|
}
|
||||||
|
|
||||||
static void ac3_update_bap_counts_c(uint16_t mant_cnt[16], uint8_t *bap,
|
static void ac3_update_bap_counts_c(uint16_t mant_cnt[16], uint8_t *bap,
|
||||||
|
|
Loading…
Reference in New Issue