har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ac3: Do not read past the end of ff_ac3_band_start_tab.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Alex Converse <alex.converse@gmail.com>
This commit is contained in:
Mans Rullgard 2012-01-31 10:20:33 -08:00 committed by Alex Converse
parent 2d1c0dea5f
commit 034b03e7a0
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/ac3dsp.c
View File

@ -108,7 +108,7 @@ static void ac3_bit_alloc_calc_bap_c(int16_t *mask, int16_t *psd,
int snr_offset, int floor, int snr_offset, int floor,
const uint8_t *bap_tab, uint8_t *bap) const uint8_t *bap_tab, uint8_t *bap)
{ {
int bin, band; int bin, band, band_end;
/* special case, if snr offset is -960, set all bap's to zero */ /* special case, if snr offset is -960, set all bap's to zero */
if (snr_offset == -960) { if (snr_offset == -960) {
@ -120,12 +120,14 @@ static void ac3_bit_alloc_calc_bap_c(int16_t *mask, int16_t *psd,
band = ff_ac3_bin_to_band_tab[start]; band = ff_ac3_bin_to_band_tab[start];
do { do {
int m = (FFMAX(mask[band] - snr_offset - floor, 0) & 0x1FE0) + floor; int m = (FFMAX(mask[band] - snr_offset - floor, 0) & 0x1FE0) + floor;
int band_end = FFMIN(ff_ac3_band_start_tab[band+1], end); band_end = ff_ac3_band_start_tab[++band];
band_end = FFMIN(band_end, end);
for (; bin < band_end; bin++) { for (; bin < band_end; bin++) {
int address = av_clip((psd[bin] - m) >> 5, 0, 63); int address = av_clip((psd[bin] - m) >> 5, 0, 63);
bap[bin] = bap_tab[address]; bap[bin] = bap_tab[address];
} }
} while (end > ff_ac3_band_start_tab[band++]); } while (end > band_end);
} }
static void ac3_update_bap_counts_c(uint16_t mant_cnt[16], uint8_t *bap, static void ac3_update_bap_counts_c(uint16_t mant_cnt[16], uint8_t *bap,