mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2024-12-22 23:33:07 +00:00
cd66606a8f
Fixes: signed integer overflow: -2146469728 - 1488954 cannot be represented in type 'int' Fixes: 62490/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-5612782399389696 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
439 lines
12 KiB
C
439 lines
12 KiB
C
/*
|
|
* Bonk audio decoder
|
|
*
|
|
* This file is part of FFmpeg.
|
|
*
|
|
* FFmpeg is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* FFmpeg is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with FFmpeg; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
#include "libavutil/internal.h"
|
|
#include "libavutil/intreadwrite.h"
|
|
#include "avcodec.h"
|
|
#include "codec_internal.h"
|
|
#include "decode.h"
|
|
#define BITSTREAM_READER_LE
|
|
#include "get_bits.h"
|
|
#include "bytestream.h"
|
|
|
|
typedef struct BitCount {
|
|
uint8_t bit;
|
|
unsigned count;
|
|
} BitCount;
|
|
|
|
typedef struct BonkContext {
|
|
GetBitContext gb;
|
|
int skip;
|
|
|
|
uint8_t *bitstream;
|
|
int64_t max_framesize;
|
|
int bitstream_size;
|
|
int bitstream_index;
|
|
|
|
uint64_t nb_samples;
|
|
int lossless;
|
|
int mid_side;
|
|
int n_taps;
|
|
int down_sampling;
|
|
int samples_per_packet;
|
|
|
|
int state[2][2048], k[2048];
|
|
int *samples[2];
|
|
int *input_samples;
|
|
uint8_t quant[2048];
|
|
BitCount *bits;
|
|
} BonkContext;
|
|
|
|
static av_cold int bonk_close(AVCodecContext *avctx)
|
|
{
|
|
BonkContext *s = avctx->priv_data;
|
|
|
|
av_freep(&s->bitstream);
|
|
av_freep(&s->input_samples);
|
|
av_freep(&s->samples[0]);
|
|
av_freep(&s->samples[1]);
|
|
av_freep(&s->bits);
|
|
s->bitstream_size = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static av_cold int bonk_init(AVCodecContext *avctx)
|
|
{
|
|
BonkContext *s = avctx->priv_data;
|
|
|
|
avctx->sample_fmt = AV_SAMPLE_FMT_S16P;
|
|
if (avctx->extradata_size < 17)
|
|
return AVERROR(EINVAL);
|
|
|
|
if (avctx->extradata[0]) {
|
|
av_log(avctx, AV_LOG_ERROR, "Unsupported version.\n");
|
|
return AVERROR_INVALIDDATA;
|
|
}
|
|
|
|
if (avctx->ch_layout.nb_channels < 1 || avctx->ch_layout.nb_channels > 2)
|
|
return AVERROR_INVALIDDATA;
|
|
|
|
s->nb_samples = AV_RL32(avctx->extradata + 1) / avctx->ch_layout.nb_channels;
|
|
if (!s->nb_samples)
|
|
s->nb_samples = UINT64_MAX;
|
|
s->lossless = avctx->extradata[10] != 0;
|
|
s->mid_side = avctx->extradata[11] != 0;
|
|
s->n_taps = AV_RL16(avctx->extradata + 12);
|
|
if (!s->n_taps || s->n_taps > 2048)
|
|
return AVERROR(EINVAL);
|
|
|
|
s->down_sampling = avctx->extradata[14];
|
|
if (!s->down_sampling)
|
|
return AVERROR(EINVAL);
|
|
|
|
s->samples_per_packet = AV_RL16(avctx->extradata + 15);
|
|
if (!s->samples_per_packet)
|
|
return AVERROR(EINVAL);
|
|
|
|
if (s->down_sampling * s->samples_per_packet < s->n_taps)
|
|
return AVERROR_INVALIDDATA;
|
|
|
|
s->max_framesize = s->samples_per_packet * avctx->ch_layout.nb_channels * s->down_sampling * 16LL;
|
|
if (s->max_framesize > (INT32_MAX - AV_INPUT_BUFFER_PADDING_SIZE) / 8)
|
|
return AVERROR_INVALIDDATA;
|
|
|
|
s->bitstream = av_calloc(s->max_framesize + AV_INPUT_BUFFER_PADDING_SIZE, sizeof(*s->bitstream));
|
|
if (!s->bitstream)
|
|
return AVERROR(ENOMEM);
|
|
|
|
s->input_samples = av_calloc(s->samples_per_packet, sizeof(*s->input_samples));
|
|
if (!s->input_samples)
|
|
return AVERROR(ENOMEM);
|
|
|
|
s->samples[0] = av_calloc(s->samples_per_packet * s->down_sampling, sizeof(*s->samples[0]));
|
|
s->samples[1] = av_calloc(s->samples_per_packet * s->down_sampling, sizeof(*s->samples[0]));
|
|
if (!s->samples[0] || !s->samples[1])
|
|
return AVERROR(ENOMEM);
|
|
|
|
s->bits = av_calloc(s->max_framesize * 8, sizeof(*s->bits));
|
|
if (!s->bits)
|
|
return AVERROR(ENOMEM);
|
|
|
|
for (int i = 0; i < 512; i++) {
|
|
s->quant[i] = sqrt(i + 1);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static unsigned read_uint_max(BonkContext *s, uint32_t max)
|
|
{
|
|
unsigned value = 0;
|
|
|
|
if (max == 0)
|
|
return 0;
|
|
|
|
av_assert0(max >> 31 == 0);
|
|
|
|
for (unsigned i = 1; i <= max - value; i+=i)
|
|
if (get_bits1(&s->gb))
|
|
value += i;
|
|
|
|
return value;
|
|
}
|
|
|
|
static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part)
|
|
{
|
|
int i, low_bits = 0, x = 0, max_x;
|
|
int n_zeros = 0, step = 256, dominant = 0;
|
|
int pos = 0, level = 0;
|
|
BitCount *bits = s->bits;
|
|
int passes = 1;
|
|
|
|
memset(buf, 0, entries * sizeof(*buf));
|
|
if (base_2_part) {
|
|
low_bits = get_bits(&s->gb, 4);
|
|
|
|
if (low_bits)
|
|
for (i = 0; i < entries; i++)
|
|
buf[i] = get_bits(&s->gb, low_bits);
|
|
}
|
|
|
|
while (n_zeros < entries) {
|
|
int steplet = step >> 8;
|
|
|
|
if (get_bits_left(&s->gb) <= 0)
|
|
return AVERROR_INVALIDDATA;
|
|
|
|
if (!get_bits1(&s->gb)) {
|
|
av_assert0(steplet >= 0);
|
|
|
|
if (steplet > 0) {
|
|
bits[x ].bit = dominant;
|
|
bits[x++].count = steplet;
|
|
}
|
|
|
|
if (!dominant)
|
|
n_zeros += steplet;
|
|
|
|
if (step > INT32_MAX*8LL/9 + 1)
|
|
return AVERROR_INVALIDDATA;
|
|
step += step / 8;
|
|
} else if (steplet > 0) {
|
|
int actual_run = read_uint_max(s, steplet - 1);
|
|
|
|
av_assert0(actual_run >= 0);
|
|
|
|
if (actual_run > 0) {
|
|
bits[x ].bit = dominant;
|
|
bits[x++].count = actual_run;
|
|
}
|
|
|
|
bits[x ].bit = !dominant;
|
|
bits[x++].count = 1;
|
|
|
|
if (!dominant)
|
|
n_zeros += actual_run;
|
|
else
|
|
n_zeros++;
|
|
|
|
step -= step / 8;
|
|
}
|
|
|
|
if (step < 256) {
|
|
step = 65536 / step;
|
|
dominant = !dominant;
|
|
}
|
|
}
|
|
|
|
max_x = x;
|
|
x = 0;
|
|
n_zeros = 0;
|
|
for (i = 0; n_zeros < entries; i++) {
|
|
if (x >= max_x)
|
|
return AVERROR_INVALIDDATA;
|
|
|
|
if (pos >= entries) {
|
|
pos = 0;
|
|
level += passes << low_bits;
|
|
passes = 1;
|
|
if (bits[x].bit && bits[x].count > entries - n_zeros)
|
|
passes = bits[x].count / (entries - n_zeros);
|
|
}
|
|
|
|
if (level > 1 << 16)
|
|
return AVERROR_INVALIDDATA;
|
|
|
|
if (buf[pos] >= level) {
|
|
if (bits[x].bit)
|
|
buf[pos] += passes << low_bits;
|
|
else
|
|
n_zeros++;
|
|
|
|
av_assert1(bits[x].count >= passes);
|
|
bits[x].count -= passes;
|
|
x += bits[x].count == 0;
|
|
}
|
|
|
|
pos++;
|
|
}
|
|
|
|
for (i = 0; i < entries; i++) {
|
|
if (buf[i] && get_bits1(&s->gb)) {
|
|
buf[i] = -buf[i];
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline int shift_down(int a, int b)
|
|
{
|
|
return (a >> b) + (a < 0);
|
|
}
|
|
|
|
static inline int shift(int a, int b)
|
|
{
|
|
return a + (1 << b - 1) >> b;
|
|
}
|
|
|
|
#define LATTICE_SHIFT 10
|
|
#define SAMPLE_SHIFT 4
|
|
#define SAMPLE_FACTOR (1 << SAMPLE_SHIFT)
|
|
|
|
static int predictor_calc_error(int *k, int *state, int order, int error)
|
|
{
|
|
int i, x = error - (unsigned)shift_down(k[order-1] * (unsigned)state[order-1], LATTICE_SHIFT);
|
|
int *k_ptr = &(k[order-2]),
|
|
*state_ptr = &(state[order-2]);
|
|
|
|
for (i = order-2; i >= 0; i--, k_ptr--, state_ptr--) {
|
|
unsigned k_value = *k_ptr, state_value = *state_ptr;
|
|
|
|
x -= (unsigned) shift_down(k_value * (unsigned)state_value, LATTICE_SHIFT);
|
|
state_ptr[1] = state_value + shift_down(k_value * x, LATTICE_SHIFT);
|
|
}
|
|
|
|
// don't drift too far, to avoid overflows
|
|
x = av_clip(x, -(SAMPLE_FACTOR << 16), SAMPLE_FACTOR << 16);
|
|
|
|
state[0] = x;
|
|
|
|
return x;
|
|
}
|
|
|
|
static void predictor_init_state(int *k, unsigned *state, int order)
|
|
{
|
|
for (int i = order - 2; i >= 0; i--) {
|
|
unsigned x = state[i];
|
|
|
|
for (int j = 0, p = i + 1; p < order; j++, p++) {
|
|
int tmp = x + shift_down(k[j] * state[p], LATTICE_SHIFT);
|
|
|
|
state[p] += shift_down(k[j] * x, LATTICE_SHIFT);
|
|
x = tmp;
|
|
}
|
|
}
|
|
}
|
|
|
|
static int bonk_decode(AVCodecContext *avctx, AVFrame *frame,
|
|
int *got_frame_ptr, AVPacket *pkt)
|
|
{
|
|
BonkContext *s = avctx->priv_data;
|
|
GetBitContext *gb = &s->gb;
|
|
const uint8_t *buf;
|
|
int quant, n, buf_size, input_buf_size;
|
|
int ret = AVERROR_INVALIDDATA;
|
|
|
|
if ((!pkt->size && !s->bitstream_size) || s->nb_samples == 0) {
|
|
*got_frame_ptr = 0;
|
|
return pkt->size;
|
|
}
|
|
|
|
buf_size = FFMIN(pkt->size, s->max_framesize - s->bitstream_size);
|
|
input_buf_size = buf_size;
|
|
if (s->bitstream_index + s->bitstream_size + buf_size + AV_INPUT_BUFFER_PADDING_SIZE > s->max_framesize) {
|
|
memmove(s->bitstream, &s->bitstream[s->bitstream_index], s->bitstream_size);
|
|
s->bitstream_index = 0;
|
|
}
|
|
if (pkt->data)
|
|
memcpy(&s->bitstream[s->bitstream_index + s->bitstream_size], pkt->data, buf_size);
|
|
buf = &s->bitstream[s->bitstream_index];
|
|
buf_size += s->bitstream_size;
|
|
s->bitstream_size = buf_size;
|
|
if (buf_size < s->max_framesize && pkt->data) {
|
|
*got_frame_ptr = 0;
|
|
return input_buf_size;
|
|
}
|
|
|
|
frame->nb_samples = FFMIN(s->samples_per_packet * s->down_sampling, s->nb_samples);
|
|
if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
|
|
goto fail;
|
|
|
|
if ((ret = init_get_bits8(gb, buf, buf_size)) < 0)
|
|
goto fail;
|
|
|
|
skip_bits(gb, s->skip);
|
|
if ((ret = intlist_read(s, s->k, s->n_taps, 0)) < 0)
|
|
goto fail;
|
|
|
|
for (int i = 0; i < s->n_taps; i++)
|
|
s->k[i] *= s->quant[i];
|
|
quant = s->lossless ? 1 : get_bits(&s->gb, 16) * SAMPLE_FACTOR;
|
|
|
|
for (int ch = 0; ch < avctx->ch_layout.nb_channels; ch++) {
|
|
const int samples_per_packet = s->samples_per_packet;
|
|
const int down_sampling = s->down_sampling;
|
|
const int offset = samples_per_packet * down_sampling - 1;
|
|
int *state = s->state[ch];
|
|
int *sample = s->samples[ch];
|
|
|
|
predictor_init_state(s->k, state, s->n_taps);
|
|
if ((ret = intlist_read(s, s->input_samples, samples_per_packet, 1)) < 0)
|
|
goto fail;
|
|
|
|
for (int i = 0; i < samples_per_packet; i++) {
|
|
for (int j = 0; j < s->down_sampling - 1; j++) {
|
|
sample[0] = predictor_calc_error(s->k, state, s->n_taps, 0);
|
|
sample++;
|
|
}
|
|
|
|
sample[0] = predictor_calc_error(s->k, state, s->n_taps, s->input_samples[i] * (unsigned)quant);
|
|
sample++;
|
|
}
|
|
|
|
sample = s->samples[ch];
|
|
for (int i = 0; i < s->n_taps; i++)
|
|
state[i] = sample[offset - i];
|
|
}
|
|
|
|
if (s->mid_side && avctx->ch_layout.nb_channels == 2) {
|
|
for (int i = 0; i < frame->nb_samples; i++) {
|
|
s->samples[1][i] += shift(s->samples[0][i], 1);
|
|
s->samples[0][i] -= s->samples[1][i];
|
|
}
|
|
}
|
|
|
|
if (!s->lossless) {
|
|
for (int ch = 0; ch < avctx->ch_layout.nb_channels; ch++) {
|
|
int *samples = s->samples[ch];
|
|
for (int i = 0; i < frame->nb_samples; i++)
|
|
samples[i] = shift(samples[i], 4);
|
|
}
|
|
}
|
|
|
|
for (int ch = 0; ch < avctx->ch_layout.nb_channels; ch++) {
|
|
int16_t *osamples = (int16_t *)frame->extended_data[ch];
|
|
int *samples = s->samples[ch];
|
|
for (int i = 0; i < frame->nb_samples; i++)
|
|
osamples[i] = av_clip_int16(samples[i]);
|
|
}
|
|
|
|
s->nb_samples -= frame->nb_samples;
|
|
|
|
s->skip = get_bits_count(gb) - 8 * (get_bits_count(gb) / 8);
|
|
n = get_bits_count(gb) / 8;
|
|
|
|
if (n > buf_size) {
|
|
fail:
|
|
s->bitstream_size = 0;
|
|
s->bitstream_index = 0;
|
|
return AVERROR_INVALIDDATA;
|
|
}
|
|
|
|
*got_frame_ptr = 1;
|
|
|
|
if (s->bitstream_size) {
|
|
s->bitstream_index += n;
|
|
s->bitstream_size -= n;
|
|
return input_buf_size;
|
|
}
|
|
return n;
|
|
}
|
|
|
|
const FFCodec ff_bonk_decoder = {
|
|
.p.name = "bonk",
|
|
CODEC_LONG_NAME("Bonk audio"),
|
|
.p.type = AVMEDIA_TYPE_AUDIO,
|
|
.p.id = AV_CODEC_ID_BONK,
|
|
.priv_data_size = sizeof(BonkContext),
|
|
.init = bonk_init,
|
|
FF_CODEC_DECODE_CB(bonk_decode),
|
|
.close = bonk_close,
|
|
.p.capabilities = AV_CODEC_CAP_DELAY |
|
|
#if FF_API_SUBFRAMES
|
|
AV_CODEC_CAP_SUBFRAMES |
|
|
#endif
|
|
AV_CODEC_CAP_DR1,
|
|
.caps_internal = FF_CODEC_CAP_INIT_CLEANUP,
|
|
.p.sample_fmts = (const enum AVSampleFormat[]) { AV_SAMPLE_FMT_S16P,
|
|
AV_SAMPLE_FMT_NONE },
|
|
};
|