From 521cbcb7d37fa12bf1038d1a73bbabcbf62589ed Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Wed, 10 Jul 2013 19:00:15 +0200 Subject: [PATCH 1/3] dca: Respect the current limits in the downmixing capabilities Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 3802833bc1f79775a1547c5e427fed6e92b77e53) Signed-off-by: Luca Barbato --- libavcodec/dca.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavcodec/dca.c b/libavcodec/dca.c index 61a056e13a..169c9b41b9 100644 --- a/libavcodec/dca.c +++ b/libavcodec/dca.c @@ -805,6 +805,13 @@ static int dca_subframe_header(DCAContext *s, int base_channel, int block_index) "Invalid channel mode %d\n", am); return AVERROR_INVALIDDATA; } + + if (s->prim_channels > FF_ARRAY_ELEMS(dca_default_coeffs[0])) { + av_log_ask_for_sample(s->avctx, "Downmixing %d channels", + s->prim_channels); + return AVERROR_PATCHWELCOME; + } + for (j = base_channel; j < s->prim_channels; j++) { s->downmix_coef[j][0] = dca_default_coeffs[am][j][0]; s->downmix_coef[j][1] = dca_default_coeffs[am][j][1]; From 763519536b63636006c9a421a4b83a58d353b84e Mon Sep 17 00:00:00 2001 From: Justin Ruggles Date: Wed, 20 Feb 2013 11:41:20 -0500 Subject: [PATCH 2/3] ac3dec: validate channel output mode against channel count Damaged frames can lead to a mismatch, which can cause a segfault due to using an incorrect channel mapping. CC:libav-stable@libav.org (cherry picked from commit d7c450436fcb9d3ecf59884a574e7684183e753d) Conflicts: libavcodec/ac3dec.c --- libavcodec/ac3dec.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index 28a783a075..61097e99d9 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -1373,8 +1373,10 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data, if (!err) { avctx->sample_rate = s->sample_rate; avctx->bit_rate = s->bit_rate; + } - /* channel config */ + /* channel config */ + if (!err || (s->channels && s->out_channels != s->channels)) { s->out_channels = s->channels; s->output_mode = s->channel_mode; if (s->lfe_on) @@ -1393,18 +1395,18 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data, s->fbw_channels == s->out_channels)) { set_downmix_coeffs(s); } - } else if (!s->out_channels) { - s->out_channels = avctx->channels; - if (s->out_channels < s->channels) - s->output_mode = s->out_channels == 1 ? AC3_CHMODE_MONO : AC3_CHMODE_STEREO; + } else if (!s->channels) { + av_log(avctx, AV_LOG_ERROR, "unable to determine channel mode\n"); + return AVERROR_INVALIDDATA; } + avctx->channels = s->out_channels; + /* set audio service type based on bitstream mode for AC-3 */ avctx->audio_service_type = s->bitstream_mode; if (s->bitstream_mode == 0x7 && s->channels > 1) avctx->audio_service_type = AV_AUDIO_SERVICE_TYPE_KARAOKE; /* get output buffer */ - avctx->channels = s->out_channels; s->frame.nb_samples = s->num_blocks * 256; if ((ret = avctx->get_buffer(avctx, &s->frame)) < 0) { av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); From 68b100871961c3e6450871367630e5bf830f6cfd Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Sat, 21 Sep 2013 15:33:11 +0200 Subject: [PATCH 3/3] adpcm: Unbreak ima-dk4 Was broken by commit b9dea1a085c4705e480bd17dfa8c8ce227fdce76 --- libavcodec/adpcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index 476315c610..5f7f140a9d 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -708,7 +708,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, src++; *samples++ = cs->predictor; } - for (n = (nb_samples >> (1 - st)) - 1; n > 0; n--) { + for (n = (nb_samples >> (1 - st)) - 1; n > 0; n--, src++) { uint8_t v = *src; *samples++ = adpcm_ima_expand_nibble(&c->status[0 ], v >> 4 , 3); *samples++ = adpcm_ima_expand_nibble(&c->status[st], v & 0x0F, 3);