wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sbr_qmf_analysis: sanitize input for 32-bit imdct

Browse source 
If the input contains too many too large values, the imdct can overflow.
Even if it didn't, the output would be larger than the valid range of 29
bits.

Note that this is a very delicate limit: Allowing values up to 1<<25
does not prevent input larger than 1<<29 from arriving at
sbr_sum_square, while limiting values to 1<<23 breaks the
fate-aac-fixed-al_sbr_hq_cm_48_5.1 test.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2015-11-18 13:43:01 +01:00
parent a9c20e922c
commit fdc94db37e
1 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
libavcodec/aacsbr_template.c
View file

@ -1163,6 +1163,9 @@ static void sbr_qmf_analysis(AVFloatDSPContext *dsp, FFTContext *mdct,
INTFLOAT z[320], INTFLOAT W[2][32][32][2], int buf_idx)
{
int i;
#if USE_FIXED
int j;
#endif
memcpy(x , x+1024, (320-32)*sizeof(x[0]));
memcpy(x+288, in, 1024*sizeof(x[0]));
for (i = 0; i < 32; i++) { // numTimeSlots*RATE = 16*2 as 960 sample frames
@ -1170,6 +1173,21 @@ static void sbr_qmf_analysis(AVFloatDSPContext *dsp, FFTContext *mdct,
dsp->vector_fmul_reverse(z, sbr_qmf_window_ds, x, 320);
sbrdsp->sum64x5(z);
sbrdsp->qmf_pre_shuffle(z);
#if USE_FIXED
for (j = 64; j < 128; j++) {
if (z[j] > 1<<24) {
av_log(NULL, AV_LOG_WARNING,
"sbr_qmf_analysis: value %09d too large, setting to %09d\n",
z[j], 1<<24);
z[j] = 1<<24;
} else if (z[j] < -(1<<24)) {
av_log(NULL, AV_LOG_WARNING,
"sbr_qmf_analysis: value %09d too small, setting to %09d\n",
z[j], -(1<<24));
z[j] = -(1<<24);
}
}
#endif
mdct->imdct_half(mdct, z, z+64);
sbrdsp->qmf_post_shuffle(W[buf_idx][i], z);
x += 32;