[FFmpeg-cvslog] r16015 - trunk/libavcodec/ac3dec.c

[Michael Niedermayer]

On Sat, Dec 06, 2008 at 04:36:24PM +0100, jbr wrote:
> Author: jbr
> Date: Sat Dec  6 16:36:23 2008
> New Revision: 16015
> 
> Log:
> ac3dec: detect out-of-range exponents
> 
> Modified:
>    trunk/libavcodec/ac3dec.c
> 
> Modified: trunk/libavcodec/ac3dec.c
> ==============================================================================
> --- trunk/libavcodec/ac3dec.c	(original)
> +++ trunk/libavcodec/ac3dec.c	Sat Dec  6 16:36:23 2008
> @@ -372,7 +372,7 @@ static void set_downmix_coeffs(AC3Decode
>   * Decode the grouped exponents according to exponent strategy.
>   * reference: Section 7.1.3 Exponent Decoding
>   */
> -static void decode_exponents(GetBitContext *gbc, int exp_strategy, int ngrps,
> +static int decode_exponents(GetBitContext *gbc, int exp_strategy, int ngrps,
>                               uint8_t absexp, int8_t *dexps)
>  {
>      int i, j, grp, group_size;
> @@ -391,11 +391,14 @@ static void decode_exponents(GetBitConte
>      /* convert to absolute exps and expand groups */
>      prevexp = absexp;
>      for(i=0; i<ngrps*3; i++) {
> -        prevexp = av_clip(prevexp + dexp[i]-2, 0, 24);
> +        prevexp += dexp[i] - 2;
> +        if (prevexp < 0 || prevexp > 24)
> +            return -1;
>          for(j=0; j<group_size; j++) {
>              dexps[(i*group_size)+j] = prevexp;
>          }

(prevexp > 24U) == (prevexp < 0 || prevexp > 24)


[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Freedom in capitalist society always remains about the same as it was in
ancient Greek republics: Freedom for slave owners. -- Vladimir Lenin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-cvslog/attachments/20081206/7047c7ac/attachment.pgp>