avcodec/vp9: Fix stack-buffer overflow with VP9 VDPAU available

[ffmpeg] / libavcodec / mpeg4audio.c

diff --git a/libavcodec/mpeg4audio.c b/libavcodec/mpeg4audio.c
index 219714752f9526454df6dfc961db998608013e83..77cf2fb61c7b756fab4c24d88781b88a6a61e94e 100644 (file)
--- a/libavcodec/mpeg4audio.c
+++ b/libavcodec/mpeg4audio.c
@@ -64,8 +64,21 @@ const int avpriv_mpeg4audio_sample_rates[16] = {
     24000, 22050, 16000, 12000, 11025, 8000, 7350
 };
 
-const uint8_t ff_mpeg4audio_channels[8] = {
-    0, 1, 2, 3, 4, 5, 6, 8
+const uint8_t ff_mpeg4audio_channels[14] = {
+    0,
+    1, // mono (1/0)
+    2, // stereo (2/0)
+    3, // 3/0
+    4, // 3/1
+    5, // 3/2
+    6, // 3/2.1
+    8, // 5/2.1
+    0,
+    0,
+    0,
+    7, // 3/3.1
+    8, // 3/2/2.1
+    24 // 3/3/3 - 5/2/3 - 3/0/0.2
 };
 
 static inline int get_object_type(GetBitContext *gb)
@@ -84,7 +97,7 @@ static inline int get_sample_rate(GetBitContext *gb, int *index)
 }
 
 int ff_mpeg4audio_get_config_gb(MPEG4AudioConfig *c, GetBitContext *gb,
-                                int sync_extension)
+                                int sync_extension, void *logctx)
 {
     int specific_config_bitindex, ret;
     int start_bit_index = get_bits_count(gb);
@@ -93,6 +106,10 @@ int ff_mpeg4audio_get_config_gb(MPEG4AudioConfig *c, GetBitContext *gb,
     c->chan_config = get_bits(gb, 4);
     if (c->chan_config < FF_ARRAY_ELEMS(ff_mpeg4audio_channels))
         c->channels = ff_mpeg4audio_channels[c->chan_config];
+    else {
+        av_log(logctx, AV_LOG_ERROR, "Invalid chan_config %d\n", c->chan_config);
+        return AVERROR_INVALIDDATA;
+    }
     c->sbr = -1;
     c->ps  = -1;
     if (c->object_type == AOT_SBR || (c->object_type == AOT_PS &&
@@ -114,8 +131,8 @@ int ff_mpeg4audio_get_config_gb(MPEG4AudioConfig *c, GetBitContext *gb,
 
     if (c->object_type == AOT_ALS) {
         skip_bits(gb, 5);
-        if (show_bits_long(gb, 24) != MKBETAG('\0','A','L','S'))
-            skip_bits_long(gb, 24);
+        if (show_bits(gb, 24) != MKBETAG('\0','A','L','S'))
+            skip_bits(gb, 24);
 
         specific_config_bitindex = get_bits_count(gb);
 
@@ -152,6 +169,7 @@ int ff_mpeg4audio_get_config_gb(MPEG4AudioConfig *c, GetBitContext *gb,
     return specific_config_bitindex - start_bit_index;
 }
 
+#if LIBAVCODEC_VERSION_MAJOR < 59
 int avpriv_mpeg4audio_get_config(MPEG4AudioConfig *c, const uint8_t *buf,
                                  int bit_size, int sync_extension)
 {
@@ -165,5 +183,22 @@ int avpriv_mpeg4audio_get_config(MPEG4AudioConfig *c, const uint8_t *buf,
     if (ret < 0)
         return ret;
 
-    return ff_mpeg4audio_get_config_gb(c, &gb, sync_extension);
+    return ff_mpeg4audio_get_config_gb(c, &gb, sync_extension, NULL);
+}
+#endif
+
+int avpriv_mpeg4audio_get_config2(MPEG4AudioConfig *c, const uint8_t *buf,
+                                  int size, int sync_extension, void *logctx)
+{
+    GetBitContext gb;
+    int ret;
+
+    if (size <= 0)
+        return AVERROR_INVALIDDATA;
+
+    ret = init_get_bits8(&gb, buf, size);
+    if (ret < 0)
+        return ret;
+
+    return ff_mpeg4audio_get_config_gb(c, &gb, sync_extension, logctx);
 }