On Fri, 18 Apr 2008 21:37:12 +0200 Lars T?uber <lars.taeuber at gmx.net> wrote:
> On Fri, 18 Apr 2008 22:08:24 +0200 Michael Niedermayer <michaelni at gmx.at> wrote:
> > On Fri, Apr 18, 2008 at 09:05:23PM +0200, Lars T?uber wrote:
> > > On Fri, 18 Apr 2008 15:39:43 +0200 Michael Niedermayer <michaelni at gmx.at> wrote:
> > > > On Thu, Apr 17, 2008 at 10:13:40PM +0200, Lars T?uber wrote:
> [...]
> > > > > + while (n--) {
> > > > > + ap = audio24;
> > > > > + src_LSB = src + avctx->channels * 2 * 2;
> > > > > +
> > > >
> > > > > + if (avctx->bits_per_sample == 20)
> > > > > + for (c=0; c < avctx->channels; c++, src+=4, src_LSB++ ) {
> > > > > + *ap++ = src[0]<<16 | src[1]<<8 | (*src_LSB & 0xf0);
> > > > > + *ap++ = src[2]<<16 | src[3]<<8 | (*src_LSB & 0x0f)<<4;
> > > > > + }
> > > >
> > > > Is there something that prevents channels from being larger than 8?
> > >
> > > Yes, because it's calculated as shown above. (There are only 3 bits that tell the number of channels)
> > >
> > > > The array should either be sized related to MAX_CHANNELS or channels be
> > > > checked against the size of the array.
> > >
> > > the widest sample size is 24 bits*channels => fit into int
> > > channels <= 8
> > > exactly 2 samples per block
> > > => max 2*8 ints/block
> > >
> > > Is that enough to be safe?
> >
> > Well, what if someone would store CODEC_ID_PCM_DVD in for example .mkv .avi
> > .mov ...
>
> I added a check.
> Lars
Update.
The check for (avctx->channels <= 0) has already been made earlier in this function.
Lars
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pcm_dvd.Makefile.diff
Type: text/x-diff
Size: 559 bytes
Desc: not available
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20080418/304f3a31/attachment.diff>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pcm_dvd.mpeg.diff
Type: text/x-diff
Size: 1471 bytes
Desc: not available
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20080418/304f3a31/attachment-0001.diff>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pcm_dvd.pcm.diff
Type: text/x-diff
Size: 2759 bytes
Desc: not available
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20080418/304f3a31/attachment-0002.diff>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sanity_check.pcm.diff
Type: text/x-diff
Size: 1127 bytes
Desc: not available
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20080418/304f3a31/attachment-0003.diff>