RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-11 17:55:21 +00:00
Code Issues Projects Releases Wiki Activity

ac3: Do not read past the end of ff_ac3_band_start_tab.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 034b03e7a0)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Mans Rullgard 2012-01-31 10:20:33 -08:00 committed by Reinhard Tartler
parent 00fa6ffe1a
commit 2c199cb253
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/ac3dsp.c
View File

@ -108,7 +108,7 @@ static void ac3_bit_alloc_calc_bap_c(int16_t *mask, int16_t *psd,
int snr_offset, int floor,
const uint8_t *bap_tab, uint8_t *bap)
{
int bin, band;
int bin, band, band_end;
/* special case, if snr offset is -960, set all bap's to zero */
if (snr_offset == -960) {
@ -120,12 +120,14 @@ static void ac3_bit_alloc_calc_bap_c(int16_t *mask, int16_t *psd,
band = ff_ac3_bin_to_band_tab[start];
do {
int m = (FFMAX(mask[band] - snr_offset - floor, 0) & 0x1FE0) + floor;
int band_end = FFMIN(ff_ac3_band_start_tab[band+1], end);
band_end = ff_ac3_band_start_tab[++band];
band_end = FFMIN(band_end, end);
for (; bin < band_end; bin++) {
int address = av_clip((psd[bin] - m) >> 5, 0, 63);
bap[bin] = bap_tab[address];
}
} while (end > ff_ac3_band_start_tab[band++]);
} while (end > band_end);
}
static void ac3_update_bap_counts_c(uint16_t mant_cnt[16], uint8_t *bap,