diff options
| author | Mans Rullgard <mans@mansr.com> | 2012-01-31 10:20:33 -0800 |
|---|---|---|
| committer | Alex Converse <alex.converse@gmail.com> | 2012-01-31 18:32:14 -0800 |
| commit | 034b03e7a0e8e4f8f66c82b736f2c0aa7c063ec0 (patch) | |
| tree | 436ce9eb0b0e4e64c31b76dc058104b0ffae222c /libavcodec/ac3dsp.c | |
| parent | 2d1c0dea5f6b91bec7f5fa53ec050913d851e366 (diff) | |
ac3: Do not read past the end of ff_ac3_band_start_tab.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Alex Converse <alex.converse@gmail.com>
Diffstat (limited to 'libavcodec/ac3dsp.c')
| -rw-r--r-- | libavcodec/ac3dsp.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/libavcodec/ac3dsp.c b/libavcodec/ac3dsp.c index 98c73573cb..b751aec902 100644 --- a/libavcodec/ac3dsp.c +++ b/libavcodec/ac3dsp.c @@ -108,7 +108,7 @@ static void ac3_bit_alloc_calc_bap_c(int16_t *mask, int16_t *psd, int snr_offset, int floor, const uint8_t *bap_tab, uint8_t *bap) { - int bin, band; + int bin, band, band_end; /* special case, if snr offset is -960, set all bap's to zero */ if (snr_offset == -960) { @@ -120,12 +120,14 @@ static void ac3_bit_alloc_calc_bap_c(int16_t *mask, int16_t *psd, band = ff_ac3_bin_to_band_tab[start]; do { int m = (FFMAX(mask[band] - snr_offset - floor, 0) & 0x1FE0) + floor; - int band_end = FFMIN(ff_ac3_band_start_tab[band+1], end); + band_end = ff_ac3_band_start_tab[++band]; + band_end = FFMIN(band_end, end); + for (; bin < band_end; bin++) { int address = av_clip((psd[bin] - m) >> 5, 0, 63); bap[bin] = bap_tab[address]; } - } while (end > ff_ac3_band_start_tab[band++]); + } while (end > band_end); } static void ac3_update_bap_counts_c(uint16_t mant_cnt[16], uint8_t *bap, |