Check masterbook index and subclass book index.

14_floor_masterbook_index.patch by chrome

Originally committed as revision 19991 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Google Chrome 2009-09-23 12:17:54 +00:00 committed by Michael Niedermayer
parent e5b0cfb541
commit 993092dcd3
1 changed files with 12 additions and 2 deletions

View File

@ -487,13 +487,23 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc) {
AV_DEBUG(" %d floor %d class dim: %d subclasses %d \n", i, j, floor_setup->data.t1.class_dimensions[j], floor_setup->data.t1.class_subclasses[j]); AV_DEBUG(" %d floor %d class dim: %d subclasses %d \n", i, j, floor_setup->data.t1.class_dimensions[j], floor_setup->data.t1.class_subclasses[j]);
if (floor_setup->data.t1.class_subclasses[j]) { if (floor_setup->data.t1.class_subclasses[j]) {
floor_setup->data.t1.class_masterbook[j]=get_bits(gb, 8); int bits=get_bits(gb, 8);
if (bits>=vc->codebook_count) {
av_log(vc->avccontext, AV_LOG_ERROR, "Masterbook index %d is out of range.\n", bits);
return 1;
}
floor_setup->data.t1.class_masterbook[j]=bits;
AV_DEBUG(" masterbook: %d \n", floor_setup->data.t1.class_masterbook[j]); AV_DEBUG(" masterbook: %d \n", floor_setup->data.t1.class_masterbook[j]);
} }
for(k=0;k<(1<<floor_setup->data.t1.class_subclasses[j]);++k) { for(k=0;k<(1<<floor_setup->data.t1.class_subclasses[j]);++k) {
floor_setup->data.t1.subclass_books[j][k]=(int16_t)get_bits(gb, 8)-1; int16_t bits=get_bits(gb, 8)-1;
if (bits!=-1 && bits>=vc->codebook_count) {
av_log(vc->avccontext, AV_LOG_ERROR, "Subclass book index %d is out of range.\n", bits);
return 1;
}
floor_setup->data.t1.subclass_books[j][k]=bits;
AV_DEBUG(" book %d. : %d \n", k, floor_setup->data.t1.subclass_books[j][k]); AV_DEBUG(" book %d. : %d \n", k, floor_setup->data.t1.subclass_books[j][k]);
} }