aac_adtstoasc_bsf: Check extradata memory allocation

[ffmpeg] / libavcodec / alsdec.c

diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
index 782a1b8b80cbbaab254aa4576283320d9fd4538b..4bb35cc6566213dc9b9938d5290b54e678c010dc 100644 (file)
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -25,13 +25,15 @@
  * @author Thilo Borgmann <thilo.borgmann _at_ googlemail.com>
  */
 
+#include <inttypes.h>
+
 #include "avcodec.h"
 #include "get_bits.h"
 #include "unary.h"
 #include "mpeg4audio.h"
 #include "bytestream.h"
 #include "bgmc.h"
-#include "dsputil.h"
+#include "bswapdsp.h"
 #include "internal.h"
 #include "libavutil/samplefmt.h"
 #include "libavutil/crc.h"
@@ -150,7 +152,7 @@ enum RA_Flag {
 };
 
 
-typedef struct {
+typedef struct ALSSpecificConfig {
     uint32_t samples;         ///< number of samples, 0xFFFFFFFF if unknown
     int resolution;           ///< 000 = 8-bit; 001 = 16-bit; 010 = 24-bit; 011 = 32-bit
     int floating;             ///< 1 = IEEE 32-bit floating-point, 0 = integer
@@ -176,7 +178,7 @@ typedef struct {
 } ALSSpecificConfig;
 
 
-typedef struct {
+typedef struct ALSChannelData {
     int stop_flag;
     int master_channel;
     int time_diff_flag;
@@ -186,11 +188,11 @@ typedef struct {
 } ALSChannelData;
 
 
-typedef struct {
+typedef struct ALSDecContext {
     AVCodecContext *avctx;
     ALSSpecificConfig sconf;
     GetBitContext gb;
-    DSPContext dsp;
+    BswapDSPContext bdsp;
     const AVCRC *crc_table;
     uint32_t crc_org;               ///< CRC value of the original input data
     uint32_t crc;                   ///< CRC value calculated from decoded data
@@ -225,7 +227,7 @@ typedef struct {
 } ALSDecContext;
 
 
-typedef struct {
+typedef struct ALSBlockData {
     unsigned int block_length;      ///< number of samples within the block
     unsigned int ra_block;          ///< if true, this is a random access block
     int          *const_block;      ///< if true, this is a constant value block
@@ -703,7 +705,9 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
                     int offset     = parcor_rice_table[sconf->coef_table][k][0];
                     quant_cof[k] = decode_rice(gb, rice_param) + offset;
                     if (quant_cof[k] < -64 || quant_cof[k] > 63) {
-                        av_log(avctx, AV_LOG_ERROR, "quant_cof %d is out of range\n", quant_cof[k]);
+                        av_log(avctx, AV_LOG_ERROR,
+                               "quant_cof %"PRIu32" is out of range\n",
+                               quant_cof[k]);
                         return AVERROR_INVALIDDATA;
                     }
                 }
@@ -1376,6 +1380,12 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame)
 
         for (b = 0; b < ctx->num_blocks; b++) {
             bd.block_length = div_blocks[b];
+            if (bd.block_length <= 0) {
+                av_log(ctx->avctx, AV_LOG_WARNING,
+                       "Invalid block length %u in channel data!\n",
+                       bd.block_length);
+                continue;
+            }
 
             for (c = 0; c < avctx->channels; c++) {
                 bd.const_block = ctx->const_block + c;
@@ -1526,9 +1536,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr,
                          sample++)
                         *dest++ = av_bswap16(src[sample]);
                 } else {
-                    ctx->dsp.bswap_buf((uint32_t*)ctx->crc_buffer,
-                                       (uint32_t *)frame->data[0],
-                                       ctx->cur_frame_length * avctx->channels);
+                    ctx->bdsp.bswap_buf((uint32_t *) ctx->crc_buffer,
+                                        (uint32_t *) frame->data[0],
+                                        ctx->cur_frame_length * avctx->channels);
                 }
                 crc_source = ctx->crc_buffer;
             } else {
@@ -1746,7 +1756,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
         }
     }
 
-    ff_dsputil_init(&ctx->dsp, avctx);
+    ff_bswapdsp_init(&ctx->bdsp);
 
     return 0;