From e245d4f45ca5e2b97daef5944d63323c07d545bc Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Tue, 14 Mar 2017 09:15:29 +0000 Subject: [PATCH 1/2] dca: Validate the channel map Having a mismatch between the number of channels in the stream and those in the channel map will lead to a segfault or worse. Bug-Id: 1016 CC: libav-stable@libav.org Signed-off-by: Luca Barbato --- libavcodec/dcadec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c index cd4432368c..af26dceafd 100644 --- a/libavcodec/dcadec.c +++ b/libavcodec/dcadec.c @@ -1297,6 +1297,9 @@ static int set_channel_layout(AVCodecContext *avctx, int channels, int num_core_ s->channel_order_tab = ff_dca_channel_reorder_nolfe[s->amode]; } + if (channels < ff_dca_channels[s->amode]) + return AVERROR_INVALIDDATA; + if (channels > !!s->lfe && s->channel_order_tab[channels - 1 - !!s->lfe] < 0) return AVERROR_INVALIDDATA; From a46a4f722d2fac07c57990f0f548777622599f59 Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Tue, 14 Mar 2017 09:15:30 +0000 Subject: [PATCH 2/2] dca: Refactor dca_filter_channels() a little Signed-off-by: Luca Barbato --- libavcodec/dcadec.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c index af26dceafd..fa2a2400fe 100644 --- a/libavcodec/dcadec.c +++ b/libavcodec/dcadec.c @@ -947,15 +947,16 @@ static int dca_filter_channels(DCAContext *s, int block_index, int upsample) /* 64 subbands QMF */ for (k = 0; k < s->audio_header.prim_channels; k++) { + int channel = s->channel_order_tab[k]; int32_t (*subband_samples)[SAMPLES_PER_SUBBAND] = s->dca_chan[k].subband_samples[block_index]; s->fmt_conv.int32_to_float(samples[0], subband_samples[0], DCA_SUBBANDS_X96K * SAMPLES_PER_SUBBAND); - if (s->channel_order_tab[k] >= 0) + if (channel >= 0) qmf_64_subbands(s, k, samples, - s->samples_chanptr[s->channel_order_tab[k]], + s->samples_chanptr[channel], /* Upsampling needs a factor 2 here. */ M_SQRT2 / 32768.0); } @@ -964,15 +965,16 @@ static int dca_filter_channels(DCAContext *s, int block_index, int upsample) LOCAL_ALIGNED(32, float, samples, [DCA_SUBBANDS], [SAMPLES_PER_SUBBAND]); for (k = 0; k < s->audio_header.prim_channels; k++) { + int channel = s->channel_order_tab[k]; int32_t (*subband_samples)[SAMPLES_PER_SUBBAND] = s->dca_chan[k].subband_samples[block_index]; s->fmt_conv.int32_to_float(samples[0], subband_samples[0], DCA_SUBBANDS * SAMPLES_PER_SUBBAND); - if (s->channel_order_tab[k] >= 0) + if (channel >= 0) qmf_32_subbands(s, k, samples, - s->samples_chanptr[s->channel_order_tab[k]], + s->samples_chanptr[channel], M_SQRT1_2 / 32768.0); } }