diff options
Diffstat (limited to 'libavcodec/apedec.c')
| -rw-r--r-- | libavcodec/apedec.c | 33 |
1 files changed, 18 insertions, 15 deletions
diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index d28e51aae6..1f55dab851 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -3,20 +3,20 @@ * Copyright (c) 2007 Benjamin Zores <ben@geexbox.org> * based upon libdemac from Dave Chapman. * - * This file is part of Libav. + * This file is part of FFmpeg. * - * Libav is free software; you can redistribute it and/or + * FFmpeg is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * - * Libav is distributed in the hope that it will be useful, + * FFmpeg is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public - * License along with Libav; if not, write to the Free Software + * License along with FFmpeg; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ @@ -248,6 +248,7 @@ static av_cold int ape_decode_init(AVCodecContext *avctx) av_log(avctx, AV_LOG_DEBUG, "Compression Level: %d - Flags: %d\n", s->compression_level, s->flags); if (s->compression_level % 1000 || s->compression_level > COMPRESSION_LEVEL_INSANE || + !s->compression_level || (s->fileversion < 3930 && s->compression_level == COMPRESSION_LEVEL_INSANE)) { av_log(avctx, AV_LOG_ERROR, "Incorrect compression level %d\n", s->compression_level); @@ -488,9 +489,12 @@ static inline int ape_decode_value_3860(APEContext *ctx, GetBitContext *gb, if (!rice->k) x = overflow; - else + else if(rice->k <= MIN_CACHE_BITS) { x = (overflow << rice->k) + get_bits(gb, rice->k); - + } else { + av_log(ctx->avctx, AV_LOG_ERROR, "Too many bits: %d\n", rice->k); + return AVERROR_INVALIDDATA; + } rice->ksum += x - (rice->ksum + 8 >> 4); if (rice->ksum < (rice->k ? 1 << (rice->k + 4) : 0)) rice->k--; @@ -517,9 +521,13 @@ static inline int ape_decode_value_3900(APEContext *ctx, APERice *rice) } else tmpk = (rice->k < 1) ? 0 : rice->k - 1; - if (tmpk <= 16 || ctx->fileversion < 3910) + if (tmpk <= 16 || ctx->fileversion < 3910) { + if (tmpk > 23) { + av_log(ctx->avctx, AV_LOG_ERROR, "Too many bits: %d\n", tmpk); + return AVERROR_INVALIDDATA; + } x = range_decode_bits(ctx, tmpk); - else if (tmpk <= 32) { + } else if (tmpk <= 32) { x = range_decode_bits(ctx, 16); x |= (range_decode_bits(ctx, tmpk - 16) << 16); } else { @@ -1402,7 +1410,6 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data, int32_t *sample24; int i, ch, ret; int blockstodecode; - int bytes_used = 0; /* this should never be negative, but bad things will happen if it is, so check it just to make sure. */ @@ -1467,8 +1474,6 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data, av_log(avctx, AV_LOG_ERROR, "Error reading frame header\n"); return AVERROR_INVALIDDATA; } - - bytes_used = avpkt->size; } if (!s->data) { @@ -1493,10 +1498,8 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data, /* get output buffer */ frame->nb_samples = blockstodecode; - if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) { - av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); + if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) return ret; - } s->error=0; @@ -1540,7 +1543,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data, *got_frame_ptr = 1; - return bytes_used; + return !s->samples ? avpkt->size : 0; } static void ape_flush(AVCodecContext *avctx) |