diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-10-09 04:02:03 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-10-09 04:02:03 +0200 |
| commit | c5db8b4d09762f5228eaf3c3a0017657ed27d866 (patch) | |
| tree | 59719cfc31a9e112b3f7099392506a6e1e54449f /libavcodec/aacdec.c | |
| parent | 7fb92be7e50ea4ba5712804326c6814ae02dd190 (diff) | |
| parent | a31e9f68a426f634e002282885c6c2eb1bfbea44 (diff) | |
| download | ffmpeg-c5db8b4d09762f5228eaf3c3a0017657ed27d866.tar.gz | |
Merge remote-tracking branch 'qatar/master'
* qatar/master:
lavf: fix signed overflow in avformat_find_stream_info()
vp8: fix signed overflows
motion_est: fix some signed overflows
dca: fix signed overflow in shift
aacdec: fix undefined shifts
bink: Check for various out of bound writes
bink: Check for out of bound writes when building tree
put_bits: fix invalid shift by 32 in flush_put_bits()
Conflicts:
libavcodec/bink.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/aacdec.c')
| -rw-r--r-- | libavcodec/aacdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index 09d83db4fa..684c845521 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -1131,7 +1131,7 @@ static int decode_spectrum_and_dequant(AACContext *ac, float coef[1024], GET_VLC(code, re, gb, vlc_tab, 8, 2); cb_idx = cb_vector_idx[code]; nnz = cb_idx >> 8 & 15; - bits = SHOW_UBITS(re, gb, nnz) << (32-nnz); + bits = nnz ? GET_CACHE(re, gb) : 0; LAST_SKIP_BITS(re, gb, nnz); cf = VMUL4S(cf, vq, cb_idx, bits, sf + idx); } while (len -= 4); @@ -1171,7 +1171,7 @@ static int decode_spectrum_and_dequant(AACContext *ac, float coef[1024], GET_VLC(code, re, gb, vlc_tab, 8, 2); cb_idx = cb_vector_idx[code]; nnz = cb_idx >> 8 & 15; - sign = SHOW_UBITS(re, gb, nnz) << (cb_idx >> 12); + sign = nnz ? SHOW_UBITS(re, gb, nnz) << (cb_idx >> 12) : 0; LAST_SKIP_BITS(re, gb, nnz); cf = VMUL2S(cf, vq, cb_idx, sign, sf + idx); } while (len -= 2); |