[Ffmpeg-cvslog] CVS: ffmpeg/libavcodec vorbis.c,1.16,1.17

[Alexander Strasser beastd]

Update of /cvsroot/ffmpeg/ffmpeg/libavcodec
In directory mail:/var2/tmp/cvs-serv20645/libavcodec

Modified Files:
	vorbis.c 
Log Message:
10l (malloc check with the wrong pointer)

Simplification: I have to reconsider this trees and forest thing...

Also readded and documented the check i had in the beginning and removed
before applying. It avoids a possible div by zero.


Index: vorbis.c
===================================================================
RCS file: /cvsroot/ffmpeg/ffmpeg/libavcodec/vorbis.c,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -d -r1.16 -r1.17
--- vorbis.c	4 Feb 2006 08:55:34 -0000	1.16
+++ vorbis.c	4 Feb 2006 09:59:48 -0000	1.17
@@ -545,6 +545,13 @@
             floor_setup->data.t0.rate=get_bits(gb, 16);
             floor_setup->data.t0.bark_map_size=get_bits(gb, 16);
             floor_setup->data.t0.amplitude_bits=get_bits(gb, 6);
+            /* zero would result in a div by zero later *
+             * 2^0 - 1 == 0                             */
+            if (floor_setup->data.t0.amplitude_bits == 0) {
+              av_log(vc->avccontext, AV_LOG_ERROR,
+                     "Floor 0 amplitude bits is 0.\n");
+              return 1;
+            }
             floor_setup->data.t0.amplitude_offset=get_bits(gb, 8);
             floor_setup->data.t0.num_books=get_bits(gb, 4)+1;
 
@@ -574,7 +581,7 @@
                 floor_setup->data.t0.lsp=
                     av_malloc((floor_setup->data.t0.order+1 + max_codebook_dim)
                               * sizeof(float));
-                if(!floor_setup->data.t0.book_list) { return 1; }
+                if(!floor_setup->data.t0.lsp) { return 1; }
             }
 
 #ifdef V_DEBUG /* debug output parsed headers */
@@ -1067,14 +1074,9 @@
 
                 /* calculate linear floor value */
                 {
-                    int_fast32_t pow_of_two=2, exponent=vf->amplitude_bits;
-                    if ( vf->amplitude_bits ) {
-                        while ( --exponent ) { pow_of_two <<= 1; }
-                    }
-                    else { pow_of_two=1; }
                     q=exp( (
                              ( (amplitude*vf->amplitude_offset)/
-                               ((pow_of_two-1) * sqrt(p+q)) )
+                               (((1<<vf->amplitude_bits)-1) * sqrt(p+q)) )
                              - vf->amplitude_offset ) * .11512925f
                          );
                 }