RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-28 02:12:28 +00:00
Code Issues Projects Releases Wiki Activity

wavpack: limit extra_bits to 32 and use get_bits_long

Browse Source 
More than 32 bits can't be stored in an integer and get_bits should not
be used with more than 25 bits.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2015-07-02 23:05:05 +02:00
parent 96953e2ef6
commit d0eff8857c
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/wavpack.c
View File

@ -271,7 +271,7 @@ static inline int wv_get_value_integer(WavpackFrameContext *s, uint32_t *crc,
if (s->got_extra_bits && if (s->got_extra_bits &&
get_bits_left(&s->gb_extra_bits) >= s->extra_bits) { get_bits_left(&s->gb_extra_bits) >= s->extra_bits) {
S |= get_bits(&s->gb_extra_bits, s->extra_bits); S |= get_bits_long(&s->gb_extra_bits, s->extra_bits);
*crc = *crc * 9 + (S & 0xffff) * 3 + ((unsigned)S >> 16); *crc = *crc * 9 + (S & 0xffff) * 3 + ((unsigned)S >> 16);
} }
} }
@ -835,7 +835,11 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
continue; continue;
} }
bytestream2_get_buffer(&gb, val, 4); bytestream2_get_buffer(&gb, val, 4);
if (val[0]) { if (val[0] > 32) {
av_log(avctx, AV_LOG_ERROR,
"Invalid INT32INFO, extra_bits = %d (> 32)\n", val[0]);
continue;
} else if (val[0]) {
s->extra_bits = val[0]; s->extra_bits = val[0];
} else if (val[1]) { } else if (val[1]) {
s->shift = val[1]; s->shift = val[1];