Chiebot-Mirror
/
FFmpeg
8
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

qdm2: clip array indices returned by qdm2_get_vlc().

Browse Source 
Prevents subsequent overreads when these numbers are used as indices
in arrays.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
pull/30/merge
Ronald S. Bultje 13 years ago committed by Justin Ruggles
parent 85e5b866dc
commit 64953f67f9
1 changed files with 13 additions and 5 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 18
      libavcodec/qdm2.c

18
libavcodec/qdm2.c
Unescape View File

@ -879,9 +879,13 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l
break; break;
case 30: case 30:
if (get_bits_left(gb) >= 4) if (get_bits_left(gb) >= 4) {
samples[0] = type30_dequant[qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1)]; unsigned index = qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1);
else if (index < FF_ARRAY_ELEMS(type30_dequant)) {
samples[0] = type30_dequant[index];
} else
samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
} else
samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx); samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
run = 1; run = 1;
@ -895,8 +899,12 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l
type34_predictor = samples[0]; type34_predictor = samples[0];
type34_first = 0; type34_first = 0;
} else { } else {
samples[0] = type34_delta[qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1)] / type34_div + type34_predictor; unsigned index = qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1);
type34_predictor = samples[0]; if (index < FF_ARRAY_ELEMS(type34_delta)) {
samples[0] = type34_delta[index] / type34_div + type34_predictor;
type34_predictor = samples[0];
} else
samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
} }
} else { } else {
samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx); samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);

Write Preview
Loading…
Cancel
Save