RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-03-22 10:58:04 +00:00
Code Issues Projects Releases Wiki Activity

alsdec: check sample pointer range in revert_channel_correlation

Browse Source 
Also change the type of begin, end and smp to ptrdiff_t to make the
comparison well-defined.

CC: libav-stable@libav.org
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 94bb1ce882)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This commit is contained in:
Andreas Cadhalpun 2015-04-21 19:28:30 +02:00 committed by Anton Khirnov
parent 7b66cf5ce7
commit 41a89cba60
1 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
libavcodec/alsdec.c
View File

@ -1223,6 +1223,7 @@ static int revert_channel_correlation(ALSDecContext *ctx, ALSBlockData *bd,
ALSChannelData *ch = cd[c]; ALSChannelData *ch = cd[c];
unsigned int dep = 0; unsigned int dep = 0;
unsigned int channels = ctx->avctx->channels; unsigned int channels = ctx->avctx->channels;
unsigned int channel_size = ctx->sconf.frame_length + ctx->sconf.max_order;
if (reverted[c]) if (reverted[c])
return 0; return 0;
@ -1254,9 +1255,9 @@ static int revert_channel_correlation(ALSDecContext *ctx, ALSBlockData *bd,
dep = 0; dep = 0;
while (!ch[dep].stop_flag) { while (!ch[dep].stop_flag) {
unsigned int smp; ptrdiff_t smp;
unsigned int begin = 1; ptrdiff_t begin = 1;
unsigned int end = bd->block_length - 1; ptrdiff_t end = bd->block_length - 1;
int64_t y; int64_t y;
int32_t *master = ctx->raw_samples[ch[dep].master_channel] + offset; int32_t *master = ctx->raw_samples[ch[dep].master_channel] + offset;
@ -1270,6 +1271,15 @@ static int revert_channel_correlation(ALSDecContext *ctx, ALSBlockData *bd,
end -= t; end -= t;
} }
if (FFMIN(begin - 1, begin - 1 + t) < ctx->raw_buffer - master ||
FFMAX(end + 1, end + 1 + t) > ctx->raw_buffer + channels * channel_size - master) {
av_log(ctx->avctx, AV_LOG_ERROR,
"sample pointer range [%p, %p] not contained in raw_buffer [%p, %p].\n",
master + FFMIN(begin - 1, begin - 1 + t), master + FFMAX(end + 1, end + 1 + t),
ctx->raw_buffer, ctx->raw_buffer + channels * channel_size);
return AVERROR_INVALIDDATA;
}
for (smp = begin; smp < end; smp++) { for (smp = begin; smp < end; smp++) {
y = (1 << 6) + y = (1 << 6) +
MUL64(ch[dep].weighting[0], master[smp - 1 ]) + MUL64(ch[dep].weighting[0], master[smp - 1 ]) +
@ -1282,6 +1292,16 @@ static int revert_channel_correlation(ALSDecContext *ctx, ALSBlockData *bd,
bd->raw_samples[smp] += y >> 7; bd->raw_samples[smp] += y >> 7;
} }
} else { } else {
if (begin - 1 < ctx->raw_buffer - master ||
end + 1 > ctx->raw_buffer + channels * channel_size - master) {
av_log(ctx->avctx, AV_LOG_ERROR,
"sample pointer range [%p, %p] not contained in raw_buffer [%p, %p].\n",
master + begin - 1, master + end + 1,
ctx->raw_buffer, ctx->raw_buffer + channels * channel_size);
return AVERROR_INVALIDDATA;
}
for (smp = begin; smp < end; smp++) { for (smp = begin; smp < end; smp++) {
y = (1 << 6) + y = (1 << 6) +
MUL64(ch[dep].weighting[0], master[smp - 1]) + MUL64(ch[dep].weighting[0], master[smp - 1]) +