mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2024-12-26 09:12:33 +00:00
7eabe56436
Fixes: signed integer overflow: -1575944192 + -602931200 cannot be represented in type 'int' Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QOA_fuzzer-6470469339185152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
171 lines
5.9 KiB
C
171 lines
5.9 KiB
C
/*
|
|
* QOA decoder
|
|
*
|
|
* This file is part of FFmpeg.
|
|
*
|
|
* FFmpeg is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* FFmpeg is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with FFmpeg; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
#include "avcodec.h"
|
|
#include "codec_internal.h"
|
|
#include "decode.h"
|
|
#include "get_bits.h"
|
|
#include "bytestream.h"
|
|
#include "mathops.h"
|
|
|
|
#define QOA_SLICE_LEN 20
|
|
#define QOA_LMS_LEN 4
|
|
|
|
typedef struct QOAChannel {
|
|
int history[QOA_LMS_LEN];
|
|
int weights[QOA_LMS_LEN];
|
|
} QOAChannel;
|
|
|
|
typedef struct QOAContext {
|
|
QOAChannel ch[256];
|
|
} QOAContext;
|
|
|
|
static const int16_t qoa_dequant_tab[16][8] = {
|
|
{ 1, -1, 3, -3, 5, -5, 7, -7},
|
|
{ 5, -5, 18, -18, 32, -32, 49, -49},
|
|
{ 16, -16, 53, -53, 95, -95, 147, -147},
|
|
{ 34, -34, 113, -113, 203, -203, 315, -315},
|
|
{ 63, -63, 210, -210, 378, -378, 588, -588},
|
|
{ 104, -104, 345, -345, 621, -621, 966, -966},
|
|
{ 158, -158, 528, -528, 950, -950, 1477, -1477},
|
|
{ 228, -228, 760, -760, 1368, -1368, 2128, -2128},
|
|
{ 316, -316, 1053, -1053, 1895, -1895, 2947, -2947},
|
|
{ 422, -422, 1405, -1405, 2529, -2529, 3934, -3934},
|
|
{ 548, -548, 1828, -1828, 3290, -3290, 5117, -5117},
|
|
{ 696, -696, 2320, -2320, 4176, -4176, 6496, -6496},
|
|
{ 868, -868, 2893, -2893, 5207, -5207, 8099, -8099},
|
|
{1064, -1064, 3548, -3548, 6386, -6386, 9933, -9933},
|
|
{1286, -1286, 4288, -4288, 7718, -7718, 12005, -12005},
|
|
{1536, -1536, 5120, -5120, 9216, -9216, 14336, -14336},
|
|
};
|
|
|
|
static av_cold int qoa_decode_init(AVCodecContext *avctx)
|
|
{
|
|
avctx->sample_fmt = AV_SAMPLE_FMT_S16;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int qoa_lms_predict(QOAChannel *lms)
|
|
{
|
|
int prediction = 0;
|
|
for (int i = 0; i < QOA_LMS_LEN; i++)
|
|
prediction += (unsigned)lms->weights[i] * lms->history[i];
|
|
return prediction >> 13;
|
|
}
|
|
|
|
static void qoa_lms_update(QOAChannel *lms, int sample, int residual)
|
|
{
|
|
int delta = residual >> 4;
|
|
for (int i = 0; i < QOA_LMS_LEN; i++)
|
|
lms->weights[i] += lms->history[i] < 0 ? -delta : delta;
|
|
for (int i = 0; i < QOA_LMS_LEN-1; i++)
|
|
lms->history[i] = lms->history[i+1];
|
|
lms->history[QOA_LMS_LEN-1] = sample;
|
|
}
|
|
|
|
static int qoa_decode_frame(AVCodecContext *avctx, AVFrame *frame,
|
|
int *got_frame_ptr, AVPacket *avpkt)
|
|
{
|
|
QOAContext *s = avctx->priv_data;
|
|
int ret, frame_size, nb_channels, sample_rate;
|
|
GetByteContext gb;
|
|
int16_t *samples;
|
|
|
|
bytestream2_init(&gb, avpkt->data, avpkt->size);
|
|
|
|
nb_channels = bytestream2_get_byte(&gb);
|
|
sample_rate = bytestream2_get_be24(&gb);
|
|
if (!sample_rate || !nb_channels)
|
|
return AVERROR_INVALIDDATA;
|
|
|
|
if (nb_channels != avctx->ch_layout.nb_channels) {
|
|
av_channel_layout_uninit(&avctx->ch_layout);
|
|
av_channel_layout_default(&avctx->ch_layout, nb_channels);
|
|
if ((ret = av_channel_layout_copy(&frame->ch_layout, &avctx->ch_layout)) < 0)
|
|
return ret;
|
|
}
|
|
|
|
frame->sample_rate = avctx->sample_rate = sample_rate;
|
|
|
|
frame->nb_samples = bytestream2_get_be16(&gb);
|
|
frame_size = bytestream2_get_be16(&gb);
|
|
if (frame_size > avpkt->size)
|
|
return AVERROR_INVALIDDATA;
|
|
|
|
if (avpkt->size < 8 + QOA_LMS_LEN * 4 * nb_channels +
|
|
8LL * ((frame->nb_samples + QOA_SLICE_LEN - 1) / QOA_SLICE_LEN) * nb_channels)
|
|
return AVERROR_INVALIDDATA;
|
|
|
|
if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
|
|
return ret;
|
|
samples = (int16_t *)frame->data[0];
|
|
|
|
for (int ch = 0; ch < nb_channels; ch++) {
|
|
QOAChannel *qch = &s->ch[ch];
|
|
|
|
for (int n = 0; n < QOA_LMS_LEN; n++)
|
|
qch->history[n] = sign_extend(bytestream2_get_be16u(&gb), 16);
|
|
for (int n = 0; n < QOA_LMS_LEN; n++)
|
|
qch->weights[n] = sign_extend(bytestream2_get_be16u(&gb), 16);
|
|
}
|
|
|
|
for (int sample_index = 0; sample_index < frame->nb_samples;
|
|
sample_index += QOA_SLICE_LEN) {
|
|
for (int ch = 0; ch < nb_channels; ch++) {
|
|
QOAChannel *lms = &s->ch[ch];
|
|
uint64_t slice = bytestream2_get_be64u(&gb);
|
|
int scalefactor = (slice >> 60) & 0xf;
|
|
int slice_start = sample_index * nb_channels + ch;
|
|
int slice_end = av_clip(sample_index + QOA_SLICE_LEN, 0, frame->nb_samples) * nb_channels + ch;
|
|
|
|
for (int si = slice_start; si < slice_end; si += nb_channels) {
|
|
int predicted = qoa_lms_predict(lms);
|
|
int quantized = (slice >> 57) & 0x7;
|
|
int dequantized = qoa_dequant_tab[scalefactor][quantized];
|
|
int reconstructed = av_clip_int16(predicted + dequantized);
|
|
|
|
samples[si] = reconstructed;
|
|
slice <<= 3;
|
|
|
|
qoa_lms_update(lms, reconstructed, dequantized);
|
|
}
|
|
}
|
|
}
|
|
|
|
*got_frame_ptr = 1;
|
|
|
|
return avpkt->size;
|
|
}
|
|
|
|
const FFCodec ff_qoa_decoder = {
|
|
.p.name = "qoa",
|
|
CODEC_LONG_NAME("QOA (Quite OK Audio)"),
|
|
.p.type = AVMEDIA_TYPE_AUDIO,
|
|
.p.id = AV_CODEC_ID_QOA,
|
|
.priv_data_size = sizeof(QOAContext),
|
|
.init = qoa_decode_init,
|
|
FF_CODEC_DECODE_CB(qoa_decode_frame),
|
|
.p.capabilities = AV_CODEC_CAP_CHANNEL_CONF |
|
|
AV_CODEC_CAP_DR1,
|
|
.p.sample_fmts = (const enum AVSampleFormat[]) { AV_SAMPLE_FMT_S16,
|
|
AV_SAMPLE_FMT_NONE },
|
|
};
|