diff options
Diffstat (limited to 'src/libffmpeg/libavcodec/vorbis.c')
| -rw-r--r-- | src/libffmpeg/libavcodec/vorbis.c | 19 |
1 files changed, 15 insertions, 4 deletions
diff --git a/src/libffmpeg/libavcodec/vorbis.c b/src/libffmpeg/libavcodec/vorbis.c index 9cc09bed1..de3688c91 100644 --- a/src/libffmpeg/libavcodec/vorbis.c +++ b/src/libffmpeg/libavcodec/vorbis.c @@ -20,6 +20,8 @@ */ #undef V_DEBUG +//#define V_DEBUG +//#define AV_DEBUG(...) av_log(NULL, AV_LOG_INFO, __VA_ARGS__) #include <math.h> @@ -473,7 +475,7 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc) { } for(k=0;k<(1<<floor_setup->data.t1.class_subclasses[j]);++k) { - floor_setup->data.t1.subclass_books[j][k]=get_bits(gb, 8)-1; + floor_setup->data.t1.subclass_books[j][k]=(int16_t)get_bits(gb, 8)-1; AV_DEBUG(" book %d. : %d \n", k, floor_setup->data.t1.subclass_books[j][k]); } @@ -872,10 +874,17 @@ static int vorbis_parse_id_hdr(vorbis_context *vc){ bl1=get_bits(gb, 4); vc->blocksize_0=(1<<bl0); vc->blocksize_1=(1<<bl1); - if (bl0>13 || bl0<6 || bl1>13 || bl1<6) { + if (bl0>13 || bl0<6 || bl1>13 || bl1<6 || bl1<bl0) { av_log(vc->avccontext, AV_LOG_ERROR, " Vorbis id header packet corrupt (illegal blocksize). \n"); return 3; } + // output format int16 + if (vc->blocksize_1/2 * vc->audio_channels * 2 > + AVCODEC_MAX_AUDIO_FRAME_SIZE) { + av_log(vc->avccontext, AV_LOG_ERROR, "Vorbis channel count makes " + "output packets too large.\n"); + return 4; + } vc->swin=vwin[bl0-6]; vc->lwin=vwin[bl1-6]; @@ -1345,12 +1354,14 @@ static int vorbis_residue_decode(vorbis_context *vc, vorbis_residue *vr, uint_fa AV_DEBUG("Classword: %d \n", temp); - assert(vr->classifications > 1 && vr->classifications<256 && temp<=65536); //needed for inverse[] + assert(vr->classifications > 1 && temp<=65536); //needed for inverse[] for(i=0;i<c_p_c;++i) { uint_fast32_t temp2; temp2=(((uint_fast64_t)temp) * inverse[vr->classifications])>>32; - classifs[j_times_ptns_to_read+partition_count+c_p_c-1-i]=temp-temp2*vr->classifications; + if (partition_count+c_p_c-1-i < ptns_to_read) { + classifs[j_times_ptns_to_read+partition_count+c_p_c-1-i]=temp-temp2*vr->classifications; + } temp=temp2; } } |