generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

qdm2: check "AC" codewords

Browse Source 
Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-03-06 05:04:15 +01:00
parent 5c8ffbaa7f
commit a3541896c6
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavcodec/qdm2.c
View File

@ -824,6 +824,11 @@ static int synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int le
}
} else {
n = get_bits(gb, 8);
if (n >= 243) {
av_log(NULL, AV_LOG_ERROR, "Invalid 8bit codeword\n");
return AVERROR_INVALIDDATA;
}
for (k = 0; k < 5; k++)
samples[2 * k] = dequant_1bit[joined_stereo][random_dequant_index[n][k]];
}
@ -860,6 +865,11 @@ static int synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int le
}
} else {
n = get_bits (gb, 8);
if (n >= 243) {
av_log(NULL, AV_LOG_ERROR, "Invalid 8bit codeword\n");
return AVERROR_INVALIDDATA;
}
for (k = 0; k < 5; k++)
samples[k] = dequant_1bit[joined_stereo][random_dequant_index[n][k]];
}
@ -873,6 +883,11 @@ static int synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int le
case 24:
if (get_bits_left(gb) >= 7) {
n = get_bits(gb, 7);
if (n >= 125) {
av_log(NULL, AV_LOG_ERROR, "Invalid 7bit codeword\n");
return AVERROR_INVALIDDATA;
}
for (k = 0; k < 3; k++)
samples[k] = (random_dequant_type24[n][k] - 2.0) * 0.5;
} else {