This also adds a few lines of code from master that are needed for this fix.
Thanks to Phillip for suggestions to improve the patch.
Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
... | ... |
@@ -76,6 +76,7 @@ do { \ |
76 | 76 |
#define SAMPLES_NEEDED_2(why) \ |
77 | 77 |
av_log (NULL,AV_LOG_INFO,"This file triggers some missing code. Please contact the developers.\nPosition: %s\n",why); |
78 | 78 |
|
79 |
+#define QDM2_MAX_FRAME_SIZE 512 |
|
79 | 80 |
|
80 | 81 |
typedef int8_t sb_int8_array[2][30][64]; |
81 | 82 |
|
... | ... |
@@ -168,7 +169,7 @@ typedef struct { |
168 | 168 |
/// I/O data |
169 | 169 |
const uint8_t *compressed_data; |
170 | 170 |
int compressed_size; |
171 |
- float output_buffer[1024]; |
|
171 |
+ float output_buffer[QDM2_MAX_FRAME_SIZE * MPA_MAX_CHANNELS * 2]; |
|
172 | 172 |
|
173 | 173 |
/// Synthesis filter |
174 | 174 |
MPADSPContext mpadsp; |
... | ... |
@@ -1822,7 +1823,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx) |
1822 | 1822 |
// something like max decodable tones |
1823 | 1823 |
s->group_order = av_log2(s->group_size) + 1; |
1824 | 1824 |
s->frame_size = s->group_size / 16; // 16 iterations per super block |
1825 |
- if (s->frame_size > FF_ARRAY_ELEMS(s->output_buffer) / 2) |
|
1825 |
+ |
|
1826 |
+ if (s->frame_size > QDM2_MAX_FRAME_SIZE) |
|
1826 | 1827 |
return AVERROR_INVALIDDATA; |
1827 | 1828 |
|
1828 | 1829 |
s->sub_sampling = s->fft_order - 7; |
... | ... |
@@ -1893,6 +1895,9 @@ static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out) |
1893 | 1893 |
int ch, i; |
1894 | 1894 |
const int frame_size = (q->frame_size * q->channels); |
1895 | 1895 |
|
1896 |
+ if((unsigned)frame_size > FF_ARRAY_ELEMS(q->output_buffer)/2) |
|
1897 |
+ return -1; |
|
1898 |
+ |
|
1896 | 1899 |
/* select input buffer */ |
1897 | 1900 |
q->compressed_data = in; |
1898 | 1901 |
q->compressed_size = q->checksum_size; |