RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-19 05:55:07 +00:00
Code Issues Projects Releases Wiki Activity

aacsbr: Fail early on illegal envelope counts.

Browse Source 
Originally committed as revision 22381 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Alex Converse 2010-03-09 10:25:42 +00:00
parent 8a9ee4b102
commit ed1d112931
1 changed files with 14 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
libavcodec/aacsbr.c
View File

@ -628,6 +628,13 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
if (ch_data->bs_num_env[1] == 1)
ch_data->bs_amp_res = 0;
if (ch_data->bs_num_env[1] > 4) {
av_log(ac->avccontext, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
ch_data->bs_num_env[1]);
return -1;
}
ch_data->bs_pointer = 0;
ch_data->bs_freq_res[1] = get_bits1(gb);
@ -666,6 +673,13 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
ch_data->bs_num_rel[1] = get_bits(gb, 2);
ch_data->bs_num_env[1] = ch_data->bs_num_rel[0] + ch_data->bs_num_rel[1] + 1;
if (ch_data->bs_num_env[1] > 5) {
av_log(ac->avccontext, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n",
ch_data->bs_num_env[1]);
return -1;
}
for (i = 0; i < ch_data->bs_num_rel[0]; i++)
ch_data->bs_rel_bord[0][i] = 2 * get_bits(gb, 2) + 2;
for (i = 0; i < ch_data->bs_num_rel[1]; i++)
@ -683,18 +697,6 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
ch_data->bs_pointer);
return -1;
}
if (ch_data->bs_frame_class == FIXFIX && ch_data->bs_num_env[1] > 4) {
av_log(ac->avccontext, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
ch_data->bs_num_env[1]);
return -1;
}
if (ch_data->bs_frame_class == VARVAR && ch_data->bs_num_env[1] > 5) {
av_log(ac->avccontext, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n",
ch_data->bs_num_env[1]);
return -1;
}
ch_data->bs_num_noise = (ch_data->bs_num_env[1] > 1) + 1;