Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/aacsbr_template: Do not change bs_num_env before its checked

Browse Source 
Fixes: 1489/clusterfuzz-testcase-minimized-5075102901207040
Fixes: out of array access

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/130/merge
Michael Niedermayer 8 years ago
parent 48f7757749
commit 87b08ee6d2
1 changed files with 15 additions and 13 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 28
      libavcodec/aacsbr_template.c

28
libavcodec/aacsbr_template.c
Unescape View File

@ -624,25 +624,26 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
int abs_bord_trail = 16;
int num_rel_lead, num_rel_trail;
unsigned bs_num_env_old = ch_data->bs_num_env;
int bs_frame_class, bs_num_env;
ch_data->bs_freq_res[0] = ch_data->bs_freq_res[ch_data->bs_num_env];
ch_data->bs_amp_res = sbr->bs_amp_res_header;
ch_data->t_env_num_env_old = ch_data->t_env[bs_num_env_old];
switch (ch_data->bs_frame_class = get_bits(gb, 2)) {
switch (bs_frame_class = get_bits(gb, 2)) {
case FIXFIX:
ch_data->bs_num_env = 1 << get_bits(gb, 2);
num_rel_lead = ch_data->bs_num_env - 1;
if (ch_data->bs_num_env == 1)
ch_data->bs_amp_res = 0;
if (ch_data->bs_num_env > 4) {
bs_num_env = 1 << get_bits(gb, 2);
if (bs_num_env > 4) {
av_log(ac->avctx, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
ch_data->bs_num_env);
ch_data->bs_num_env = 2;
bs_num_env);
return -1;
}
ch_data->bs_num_env = bs_num_env;
num_rel_lead = ch_data->bs_num_env - 1;
if (ch_data->bs_num_env == 1)
ch_data->bs_amp_res = 0;
ch_data->t_env[0] = 0;
ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
@ -690,15 +691,15 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
abs_bord_trail += get_bits(gb, 2);
num_rel_lead = get_bits(gb, 2);
num_rel_trail = get_bits(gb, 2);
ch_data->bs_num_env = num_rel_lead + num_rel_trail + 1;
bs_num_env = num_rel_lead + num_rel_trail + 1;
if (ch_data->bs_num_env > 5) {
if (bs_num_env > 5) {
av_log(ac->avctx, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n",
ch_data->bs_num_env);
ch_data->bs_num_env = 2;
bs_num_env);
return -1;
}
ch_data->bs_num_env = bs_num_env;
ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
@ -713,6 +714,7 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
get_bits1_vector(gb, ch_data->bs_freq_res + 1, ch_data->bs_num_env);
break;
}
ch_data->bs_frame_class = bs_frame_class;
av_assert0(bs_pointer >= 0);
if (bs_pointer > ch_data->bs_num_env + 1) {

Write Preview
Loading…
Cancel
Save