Fixes a out of array read.
Unified · Split
| @@ -717,15 +717,19 @@ static int dca_subframe_header(DCAContext *s, int base_channel, int block_index) · 716 unmodified lines | |||
| 717 | 717 | ||
| 718 | for (j = base_channel; j < s->prim_channels; j++) { | 718 | for (j = base_channel; j < s->prim_channels; j++) { |
| 719 | const uint32_t *scale_table; | 719 | const uint32_t *scale_table; |
| 720 | unsigned int scale_max; | ||
| 720 | int scale_sum; | 721 | int scale_sum; |
| 721 | 722 | ||
| 722 | memset(s->scale_factor[j], 0, | 723 | memset(s->scale_factor[j], 0, |
| 723 | s->subband_activity[j] * sizeof(s->scale_factor[0][0][0]) * 2); | 724 | s->subband_activity[j] * sizeof(s->scale_factor[0][0][0]) * 2); |
| 724 | 725 | ||
| 725 | if (s->scalefactor_huffman[j] == 6) | 726 | if (s->scalefactor_huffman[j] == 6) { |
| 726 | scale_table = scale_factor_quant7; | 727 | scale_table = scale_factor_quant7; |
| 727 | else | 728 | scale_max = 127; |
| 729 | } else { | ||
| 728 | scale_table = scale_factor_quant6; | 730 | scale_table = scale_factor_quant6; |
| 731 | scale_max = 63; | ||
| 732 | } | ||
| 729 | 733 | ||
| 730 | /* When huffman coded, only the difference is encoded */ | 734 | /* When huffman coded, only the difference is encoded */ |
| 731 | scale_sum = 0; | 735 | scale_sum = 0; |
| @@ -733,12 +737,20 @@ static int dca_subframe_header(DCAContext *s, int base_channel, int block_index) · 1 unmodified line | |||
| 733 | for (k = 0; k < s->subband_activity[j]; k++) { | 737 | for (k = 0; k < s->subband_activity[j]; k++) { |
| 734 | if (k >= s->vq_start_subband[j] || s->bitalloc[j][k] > 0) { | 738 | if (k >= s->vq_start_subband[j] || s->bitalloc[j][k] > 0) { |
| 735 | scale_sum = get_scale(&s->gb, s->scalefactor_huffman[j], scale_sum); | 739 | scale_sum = get_scale(&s->gb, s->scalefactor_huffman[j], scale_sum); |
| 740 | if (scale_sum > scale_max) { | ||
| 741 | av_log(s->avctx, AV_LOG_ERROR, "scale_sum out of range\n"); | ||
| 742 | return AVERROR_INVALIDDATA; | ||
| 743 | } | ||
| 736 | s->scale_factor[j][k][0] = scale_table[scale_sum]; | 744 | s->scale_factor[j][k][0] = scale_table[scale_sum]; |
| 737 | } | 745 | } |
| 738 | 746 | ||
| 739 | if (k < s->vq_start_subband[j] && s->transition_mode[j][k]) { | 747 | if (k < s->vq_start_subband[j] && s->transition_mode[j][k]) { |
| 740 | /* Get second scale factor */ | 748 | /* Get second scale factor */ |
| 741 | scale_sum = get_scale(&s->gb, s->scalefactor_huffman[j], scale_sum); | 749 | scale_sum = get_scale(&s->gb, s->scalefactor_huffman[j], scale_sum); |
| 750 | if (scale_sum > scale_max) { | ||
| 751 | av_log(s->avctx, AV_LOG_ERROR, "scale_sum out of range\n"); | ||
| 752 | return AVERROR_INVALIDDATA; | ||
| 753 | } | ||
| 742 | s->scale_factor[j][k][1] = scale_table[scale_sum]; | 754 | s->scale_factor[j][k][1] = scale_table[scale_sum]; |
| 743 | } | 755 | } |
| 744 | } | 756 | } |