RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/dstdec: Replace AC overread check by sample rate check 

Real files do skip coding 0 bits at the end, thus this kind of check
does not work reliable.

Fixes: Ticket 8770
Fixes: dst-256fs44-6ch-refdstencoder.dff

The samplerate is specified in ISO/IEC 14496-3:2005(E) as one of 3 fixed
values, this also can be used to limit the duration and avoid the timeout

This reverts commit f6df99dba1.
This commit is contained in:
Michael Niedermayer 2020-07-01 21:27:23 +02:00
parent c0c45e238f
commit 1679f23beb
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/dstdec.c
View File

@ -56,7 +56,6 @@ static const int8_t probs_code_pred_coeff[3][3] = {
typedef struct ArithCoder { typedef struct ArithCoder {
unsigned int a; unsigned int a;
unsigned int c; unsigned int c;
int overread;
} ArithCoder; } ArithCoder;
typedef struct Table { typedef struct Table {
@ -86,6 +85,12 @@ static av_cold int decode_init(AVCodecContext *avctx)
return AVERROR_PATCHWELCOME; return AVERROR_PATCHWELCOME;
} }
// the sample rate is only allowed to be 64,128,256 * 44100 by ISO/IEC 14496-3:2005(E)
// We are a bit more tolerant here, but this check is needed to bound the size and duration
if (avctx->sample_rate > 512 * 44100)
return AVERROR_INVALIDDATA;
if (DST_SAMPLES_PER_FRAME(avctx->sample_rate) & 7) { if (DST_SAMPLES_PER_FRAME(avctx->sample_rate) & 7) {
return AVERROR_PATCHWELCOME; return AVERROR_PATCHWELCOME;
} }
@ -181,7 +186,6 @@ static void ac_init(ArithCoder *ac, GetBitContext *gb)
{ {
ac->a = 4095; ac->a = 4095;
ac->c = get_bits(gb, 12); ac->c = get_bits(gb, 12);
ac->overread = 0;
} }
static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, int *e) static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, int *e)
@ -201,8 +205,6 @@ static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, in
if (ac->a < 2048) { if (ac->a < 2048) {
int n = 11 - av_log2(ac->a); int n = 11 - av_log2(ac->a);
ac->a <<= n; ac->a <<= n;
if (get_bits_left(gb) < n)
ac->overread ++;
ac->c = (ac->c << n) | get_bits(gb, n); ac->c = (ac->c << n) | get_bits(gb, n);
} }
} }
@ -355,9 +357,6 @@ static int decode_frame(AVCodecContext *avctx, void *data,
prob = 128; prob = 128;
} }
if (ac->overread > 16)
return AVERROR_INVALIDDATA;
ac_get(ac, gb, prob, &residual); ac_get(ac, gb, prob, &residual);
v = ((predict >> 15) ^ residual) & 1; v = ((predict >> 15) ^ residual) & 1;
dsd[((i >> 3) * channels + ch) << 2] |= v << (7 - (i & 0x7 )); dsd[((i >> 3) * channels + ch) << 2] |= v << (7 - (i & 0x7 ));