If there is an error during frame parsing, but AVCodecContext.channels was
changed and AC3DecodeContext.out_channels was set previously, the two may not
match.
Fixes CVE-2012-2802
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
That way all mix levels as exported by avpriv_ac3_parse_header()
will have the same meaning.
Previously the 3-bit center mix level for E-AC-3 was used to index in a
4-entry table, leading to out-of-array reads.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
Signed-off-by: Alex Converse <alex.converse@gmail.com>
That way all mix levels as exported by the parser
will have the same meaning.
Previously the 3bit center mix level for eac3 was
used to index in a 4 entry table leading to out of array reads.
this change removes the table and offsets the ac3 variable by 4
so it matches the meanings for eac3 except the reserved case.
The reserved case is then explicitly handled.
Idea-by: Justin Ruggles <justin.ruggles@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
A user who wishes to use default error concealment cannot set the
AV_EF_CRCCHECK flag because not every CRC in every format is a
reliable indicator of bitstream damage. In some formats crcrs
can be nonsensical in absence of any damage. We thus add the
AV_EF_CAREFUL flag in addition to the AV_EF_CRCCHECK flag to
allow a user to enable this reliable CRC check without having to
enable all CRC checks in all formats.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
They use now code identical to the AAC decoder.
The AC3 decoder previously did not check the data_size and
the dca decoder checked against and set wrong values for float.
This allows the AC-3 decoder to be used directly with RealMedia
decoders that unlike the libavformat one do not byte-swap automatically.
Since the new code is only used in case we would fail directly otherwise
there should be no risk for regressions.
Depending on error_recognition is not correct, low values do
certainly not mean it is ok to crash.
Based on a patch by Reimar Döffinger <Reimar.Doeffinger@gmx.de>
This function is not tightly coupled to mdct, and it's in the way
of making a fixed-point mdct implementation.
Signed-off-by: Mans Rullgard <mans@mansr.com>
This removes the rather pointless wrappers (one not even inline)
for calling the fft_calc and related function pointers.
Signed-off-by: Mans Rullgard <mans@mansr.com>