virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

Add extra validation checks to ff_vorbis_len2vlc.

Browse Source 
They should not be necessary, but it seems like a reasonable precaution.

Originally committed as revision 19374 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Reimar Döffinger 2009-07-08 19:39:23 +00:00
parent 1de4ba7155
commit 5e039e1b4c
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/vorbis.c
View File

@ -45,6 +45,9 @@ unsigned int ff_vorbis_nth_root(unsigned int x, unsigned int n) { // x^(1/n)
// Generate vlc codes from vorbis huffman code lengths // Generate vlc codes from vorbis huffman code lengths
// the two bits[p] > 32 checks should be redundant, all calling code should
// already ensure that, but since it allows overwriting the stack it seems
// reasonable to check redundantly.
int ff_vorbis_len2vlc(uint8_t *bits, uint32_t *codes, uint_fast32_t num) { int ff_vorbis_len2vlc(uint8_t *bits, uint32_t *codes, uint_fast32_t num) {
uint_fast32_t exit_at_level[33]={404,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, uint_fast32_t exit_at_level[33]={404,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}; 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
@ -63,6 +66,7 @@ int ff_vorbis_len2vlc(uint8_t *bits, uint32_t *codes, uint_fast32_t num) {
} }
codes[p]=0; codes[p]=0;
if (bits[p] > 32) return 1;
for(i=0;i<bits[p];++i) { for(i=0;i<bits[p];++i) {
exit_at_level[i+1]=1<<i; exit_at_level[i+1]=1<<i;
} }
@ -79,6 +83,7 @@ int ff_vorbis_len2vlc(uint8_t *bits, uint32_t *codes, uint_fast32_t num) {
++p; ++p;
for(;p<num;++p) { for(;p<num;++p) {
if (bits[p] > 32) return 1;
if (bits[p]==0) continue; if (bits[p]==0) continue;
// find corresponding exit(node which the tree can grow further from) // find corresponding exit(node which the tree can grow further from)
for(i=bits[p];i>0;--i) { for(i=bits[p];i>0;--i) {