virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-29 22:00:58 +02:00
Code Issues Releases Activity

aacsbr: Check for illegal values of bs_pointer in sbr_read_grid().

Browse Source 
Originally committed as revision 22380 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Alex Converse 2010-03-09 09:27:11 +00:00
parent e8ff21fdf5
commit 8a9ee4b102
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/aacsbr.c
View File

@ -628,6 +628,8 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
if (ch_data->bs_num_env[1] == 1)
ch_data->bs_amp_res = 0;
ch_data->bs_pointer = 0;
ch_data->bs_freq_res[1] = get_bits1(gb);
for (i = 1; i < ch_data->bs_num_env[1]; i++)
ch_data->bs_freq_res[i + 1] = ch_data->bs_freq_res[1];
@ -675,6 +677,12 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
break;
}
if (ch_data->bs_pointer > ch_data->bs_num_env[1] + 1) {
av_log(ac->avccontext, AV_LOG_ERROR,
"Invalid bitstream, bs_pointer points to a middle noise border outside the time borders table: %d\n",
ch_data->bs_pointer);
return -1;
}
if (ch_data->bs_frame_class == FIXFIX && ch_data->bs_num_env[1] > 4) {
av_log(ac->avccontext, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",