Fixes: out of array access Fixes: 394638693/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-4868142996455424
Unified · Split
| @@ -169,7 +169,7 @@ typedef struct SpeexSubmode { · 168 unmodified lines | |||
| 169 | 169 | ||
| 170 | typedef struct SpeexMode { | 170 | typedef struct SpeexMode { |
| 171 | int modeID; /**< ID of the mode */ | 171 | int modeID; /**< ID of the mode */ |
| 172 | int (*decode)(AVCodecContext *avctx, void *dec, GetBitContext *gb, float *out); | 172 | int (*decode)(AVCodecContext *avctx, void *dec, GetBitContext *gb, float *out, int packets_left); |
| 173 | int frame_size; /**< Size of frames used for decoding */ | 173 | int frame_size; /**< Size of frames used for decoding */ |
| 174 | int subframe_size; /**< Size of sub-frames used for decoding */ | 174 | int subframe_size; /**< Size of sub-frames used for decoding */ |
| 175 | int lpc_size; /**< Order of LPC filter */ | 175 | int lpc_size; /**< Order of LPC filter */ |
| @@ -521,8 +521,8 @@ static const SpeexSubmode wb_submode4 = { · 345 unmodified lines | |||
| 521 | split_cb_shape_sign_unquant, &split_cb_high, -1.f | 521 | split_cb_shape_sign_unquant, &split_cb_high, -1.f |
| 522 | }; | 522 | }; |
| 523 | 523 | ||
| 524 | static int nb_decode(AVCodecContext *, void *, GetBitContext *, float *); | 524 | static int nb_decode(AVCodecContext *, void *, GetBitContext *, float *, int packets_left); |
| 525 | static int sb_decode(AVCodecContext *, void *, GetBitContext *, float *); | 525 | static int sb_decode(AVCodecContext *, void *, GetBitContext *, float *, int packets_left); |
| 526 | 526 | ||
| 527 | static const SpeexMode speex_modes[SPEEX_NB_MODES] = { | 527 | static const SpeexMode speex_modes[SPEEX_NB_MODES] = { |
| 528 | { | 528 | { |
| @@ -867,7 +867,7 @@ static void lsp_to_lpc(const float *freq, float *ak, int lpcrdr) · 338 unmodified lines | |||
| 867 | } | 867 | } |
| 868 | 868 | ||
| 869 | static int nb_decode(AVCodecContext *avctx, void *ptr_st, | 869 | static int nb_decode(AVCodecContext *avctx, void *ptr_st, |
| 870 | GetBitContext *gb, float *out) | 870 | GetBitContext *gb, float *out, int packets_left) |
| 871 | { | 871 | { |
| 872 | DecoderState *st = ptr_st; | 872 | DecoderState *st = ptr_st; |
| 873 | float ol_gain = 0, ol_pitch_coef = 0, best_pitch_gain = 0, pitch_average = 0; | 873 | float ol_gain = 0, ol_pitch_coef = 0, best_pitch_gain = 0, pitch_average = 0; |
| @@ -1218,7 +1218,7 @@ static void qmf_synth(const float *x1, const float *x2, const float *a, float *y · 344 unmodified lines | |||
| 1218 | } | 1218 | } |
| 1219 | 1219 | ||
| 1220 | static int sb_decode(AVCodecContext *avctx, void *ptr_st, | 1220 | static int sb_decode(AVCodecContext *avctx, void *ptr_st, |
| 1221 | GetBitContext *gb, float *out) | 1221 | GetBitContext *gb, float *out, int packets_left) |
| 1222 | { | 1222 | { |
| 1223 | SpeexContext *s = avctx->priv_data; | 1223 | SpeexContext *s = avctx->priv_data; |
| 1224 | DecoderState *st = ptr_st; | 1224 | DecoderState *st = ptr_st; |
| @@ -1234,9 +1234,11 @@ static int sb_decode(AVCodecContext *avctx, void *ptr_st, · 9 unmodified lines | |||
| 1234 | mode = st->mode; | 1234 | mode = st->mode; |
| 1235 | 1235 | ||
| 1236 | if (st->modeID > 0) { | 1236 | if (st->modeID > 0) { |
| 1237 | if (packets_left <= 1) | ||
| 1238 | return AVERROR_INVALIDDATA; | ||
| 1237 | low_innov_alias = out + st->frame_size; | 1239 | low_innov_alias = out + st->frame_size; |
| 1238 | s->st[st->modeID - 1].innov_save = low_innov_alias; | 1240 | s->st[st->modeID - 1].innov_save = low_innov_alias; |
| 1239 | ret = speex_modes[st->modeID - 1].decode(avctx, &s->st[st->modeID - 1], gb, out); | 1241 | ret = speex_modes[st->modeID - 1].decode(avctx, &s->st[st->modeID - 1], gb, out, packets_left); |
| 1240 | if (ret < 0) | 1242 | if (ret < 0) |
| 1241 | return ret; | 1243 | return ret; |
| 1242 | } | 1244 | } |
| @@ -1559,7 +1561,7 @@ static int speex_decode_frame(AVCodecContext *avctx, AVFrame *frame, · 316 unmodified lines | |||
| 1559 | 1561 | ||
| 1560 | dst = (float *)frame->extended_data[0]; | 1562 | dst = (float *)frame->extended_data[0]; |
| 1561 | for (int i = 0; i < frames_per_packet; i++) { | 1563 | for (int i = 0; i < frames_per_packet; i++) { |
| 1562 | ret = speex_modes[s->mode].decode(avctx, &s->st[s->mode], &s->gb, dst + i * s->frame_size); | 1564 | ret = speex_modes[s->mode].decode(avctx, &s->st[s->mode], &s->gb, dst + i * s->frame_size, frames_per_packet - i); |
| 1563 | if (ret < 0) | 1565 | if (ret < 0) |
| 1564 | return ret; | 1566 | return ret; |
| 1565 | if (avctx->ch_layout.nb_channels == 2) | 1567 | if (avctx->ch_layout.nb_channels == 2) |