diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-05-02 16:12:46 +0000 |
|---|---|---|
| committer | Derek Buitenhuis <derek.buitenhuis@gmail.com> | 2012-06-02 19:25:12 -0400 |
| commit | 4bccd5a36bb14d9befecdc10cd8c4c4a5d3d24fe (patch) | |
| tree | 6a81167323f61a3020a1bbce36eaebd9599ef11b | |
| parent | 07bff951764c129d39ab2e06a644b13d1f0d6e48 (diff) | |
| download | ffmpeg-4bccd5a36bb14d9befecdc10cd8c4c4a5d3d24fe.tar.gz | |
qdm2: clip array indices returned by qdm2_get_vlc().
Prevents subsequent overreads when these numbers are used as indices
in arrays.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 64953f67f98da2e787aeb45cc7f504390fa32a69)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Conflicts:
libavcodec/qdm2.c
| -rw-r--r-- | libavcodec/qdm2.c | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c index 839e3fe1bf..946f7d29f7 100644 --- a/libavcodec/qdm2.c +++ b/libavcodec/qdm2.c @@ -883,9 +883,13 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l break; case 30: - if (BITS_LEFT(length,gb) >= 4) - samples[0] = type30_dequant[qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1)]; - else + if (BITS_LEFT(length,gb) >= 4) { + unsigned index = qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1); + if (index < FF_ARRAY_ELEMS(type30_dequant)) { + samples[0] = type30_dequant[index]; + } else + samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx); + } else samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx); run = 1; @@ -899,8 +903,12 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l type34_predictor = samples[0]; type34_first = 0; } else { - samples[0] = type34_delta[qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1)] / type34_div + type34_predictor; - type34_predictor = samples[0]; + unsigned index = qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1); + if (index < FF_ARRAY_ELEMS(type34_delta)) { + samples[0] = type34_delta[index] / type34_div + type34_predictor; + type34_predictor = samples[0]; + } else + samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx); } } else { samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx); |