From a91d82b5cc7d828ea9779aae1595f60e7e257d29 Mon Sep 17 00:00:00 2001
From: Alex Converse <alex.converse@gmail.com>
Date: Fri, 30 Apr 2010 23:08:44 +0000
Subject: [PATCH] Move the SBR patch count check to prevent overwrites.
Thanks to Chromium.
Originally committed as revision 22999 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
libavcodec/aacsbr.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/libavcodec/aacsbr.c b/libavcodec/aacsbr.c
index ec6f9151b04..bc6cb003cbf 100644
--- a/libavcodec/aacsbr.c
+++ b/libavcodec/aacsbr.c
@@ -519,6 +519,15 @@ static int sbr_hf_calc_npatches(AACContext *ac, SpectralBandReplication *sbr)
odd = (sb + sbr->k[0]) & 1;
}
+ // Requirements (14496-3 sp04 p205) sets the maximum number of patches to 5.
+ // After this check the final number of patches can still be six which is
+ // illegal however the Coding Technologies decoder check stream has a final
+ // count of 6 patches
+ if (sbr->num_patches > 5) {
+ av_log(ac->avccontext, AV_LOG_ERROR, "Too many patches: %d\n", sbr->num_patches);
+ return -1;
+ }
+
sbr->patch_num_subbands[sbr->num_patches] = FFMAX(sb - usb, 0);
sbr->patch_start_subband[sbr->num_patches] = sbr->k[0] - odd - sbr->patch_num_subbands[sbr->num_patches];
@@ -536,13 +545,6 @@ static int sbr_hf_calc_npatches(AACContext *ac, SpectralBandReplication *sbr)
if (sbr->patch_num_subbands[sbr->num_patches-1] < 3 && sbr->num_patches > 1)
sbr->num_patches--;
- // Requirements (14496-3 sp04 p205) sets the maximum number of patches to 5
- // However the Coding Technologies decoder check uses 6 patches
- if (sbr->num_patches > 6) {
- av_log(ac->avccontext, AV_LOG_ERROR, "Too many patches: %d\n", sbr->num_patches);
- return -1;
- }
-
return 0;
}
--
GitLab