RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/aacsbr: check that the element type matches before applying SBR 

Fixes out of array access
Fixes: signal_sigsegv_3670fc0_2818_cov_2307326154_moon.mux

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 79a98294da)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2015-07-01 02:05:43 +02:00 committed by Michael Niedermayer
parent 58070590b1
commit 1b15487e90
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/aacsbr.c
View File

@ -1018,6 +1018,8 @@ static unsigned int read_sbr_data(AACContext *ac, SpectralBandReplication *sbr,
{
unsigned int cnt = get_bits_count(gb);
sbr->id_aac = id_aac;
if (id_aac == TYPE_SCE || id_aac == TYPE_CCE) {
if (read_sbr_single_channel_element(ac, sbr, gb)) {
sbr_turnoff(sbr);
@ -1694,6 +1696,12 @@ void ff_sbr_apply(AACContext *ac, SpectralBandReplication *sbr, int id_aac,
int nch = (id_aac == TYPE_CPE) ? 2 : 1;
int err;
if (id_aac != sbr->id_aac) {
av_log(ac->avctx, AV_LOG_ERROR,
"element type mismatch %d != %d\n", id_aac, sbr->id_aac);
sbr_turnoff(sbr);
}
if (!sbr->kx_and_m_pushed) {
sbr->kx[0] = sbr->kx[1];
sbr->m[0] = sbr->m[1];

1
libavcodec/sbr.h
View File

@ -137,6 +137,7 @@ typedef struct AACSBRContext {
struct SpectralBandReplication {
int sample_rate;
int start;
int id_aac;
int reset;
SpectrumParameters spectrum_params;
int bs_amp_res_header;