Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

ac3: Do not read past the end of ff_ac3_band_start_tab.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Alex Converse <alex.converse@gmail.com>
pull/3/merge
Mans Rullgard 13 years ago committed by Alex Converse
parent 2d1c0dea5f
commit 034b03e7a0
1 changed files with 5 additions and 3 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 8
      libavcodec/ac3dsp.c

8
libavcodec/ac3dsp.c
Unescape View File

@ -108,7 +108,7 @@ static void ac3_bit_alloc_calc_bap_c(int16_t *mask, int16_t *psd,
int snr_offset, int floor, int snr_offset, int floor,
const uint8_t *bap_tab, uint8_t *bap) const uint8_t *bap_tab, uint8_t *bap)
{ {
int bin, band; int bin, band, band_end;
/* special case, if snr offset is -960, set all bap's to zero */ /* special case, if snr offset is -960, set all bap's to zero */
if (snr_offset == -960) { if (snr_offset == -960) {
@ -120,12 +120,14 @@ static void ac3_bit_alloc_calc_bap_c(int16_t *mask, int16_t *psd,
band = ff_ac3_bin_to_band_tab[start]; band = ff_ac3_bin_to_band_tab[start];
do { do {
int m = (FFMAX(mask[band] - snr_offset - floor, 0) & 0x1FE0) + floor; int m = (FFMAX(mask[band] - snr_offset - floor, 0) & 0x1FE0) + floor;
int band_end = FFMIN(ff_ac3_band_start_tab[band+1], end); band_end = ff_ac3_band_start_tab[++band];
band_end = FFMIN(band_end, end);
for (; bin < band_end; bin++) { for (; bin < band_end; bin++) {
int address = av_clip((psd[bin] - m) >> 5, 0, 63); int address = av_clip((psd[bin] - m) >> 5, 0, 63);
bap[bin] = bap_tab[address]; bap[bin] = bap_tab[address];
} }
} while (end > ff_ac3_band_start_tab[band++]); } while (end > band_end);
} }
static void ac3_update_bap_counts_c(uint16_t mant_cnt[16], uint8_t *bap, static void ac3_update_bap_counts_c(uint16_t mant_cnt[16], uint8_t *bap,

Write Preview
Loading…
Cancel
Save