Fix an exploit in indeo by checking we are not writing out of the strip array.

[ffmpeg] / libavcodec / ra144.c

diff --git a/libavcodec/ra144.c b/libavcodec/ra144.c
index 35d4a50c448a03e189b64267d78aa9ac6cb0b018..01cbc86f3ec5d70d55d3d4bd4c955ca1b3d2f27a 100644 (file)
--- a/libavcodec/ra144.c
+++ b/libavcodec/ra144.c
@@ -25,7 +25,7 @@
 #include "avcodec.h"
 #include "bitstream.h"
 #include "ra144.h"
-#include "acelp_filters.h"
+#include "celp_filters.h"
 
 #define NBLOCKS         4       ///< number of subblocks within a block
 #define BLOCKSIZE       40      ///< subblock size in 16-bit words
@@ -38,16 +38,16 @@ typedef struct {
     unsigned int     lpc_tables[2][10];
 
     /** LPC coefficients: lpc_coef[0] is the coefficients of the current frame
-     *  and lpc_coef[1] of the previous one */
+     *  and lpc_coef[1] of the previous one. */
     unsigned int    *lpc_coef[2];
 
     unsigned int     lpc_refl_rms[2];
 
-    /** the current subblock padded by the last 10 values of the previous one*/
+    /** The current subblock padded by the last 10 values of the previous one. */
     int16_t curr_sblock[50];
 
-    /** adaptive codebook. Its size is two units bigger to avoid a
-     *  buffer overflow */
+    /** Adaptive codebook, its size is two units bigger to avoid a
+     *  buffer overflow. */
     uint16_t adapt_cb[146+2];
 } RA144Context;
 
@@ -136,7 +136,7 @@ static void add_wav(int16_t *dest, int n, int skip_first, int *m,
 
     v[0] = 0;
     for (i=!skip_first; i<3; i++)
-        v[i] = (gain_val_tab[n][i] * m[i]) >> (gain_exp_tab[n][i] + 1);
+        v[i] = (gain_val_tab[n][i] * m[i]) >> gain_exp_tab[n];
 
     for (i=0; i < BLOCKSIZE; i++)
         dest[i] = (s1[i]*v[0] + s2[i]*v[1] + s3[i]*v[2]) >> 12;
@@ -201,8 +201,8 @@ static void do_output_subblock(RA144Context *ractx, const uint16_t  *lpc_coefs,
     memcpy(ractx->curr_sblock, ractx->curr_sblock + 40,
            10*sizeof(*ractx->curr_sblock));
 
-    if (ff_acelp_lp_synthesis_filter(ractx->curr_sblock + 10, lpc_coefs,
-                                     block, BLOCKSIZE, 10, 1, 0xfff))
+    if (ff_celp_lp_synthesis_filter(ractx->curr_sblock + 10, lpc_coefs,
+                                    block, BLOCKSIZE, 10, 1, 0xfff))
         memset(ractx->curr_sblock, 0, 50*sizeof(*ractx->curr_sblock));
 }
 
@@ -218,7 +218,7 @@ static void int_to_int16(int16_t *out, const int *inp)
  * Evaluate the reflection coefficients from the filter coefficients.
  * Does the inverse of the eval_coefs() function.
  *
- * @return 1 if one of the reflection coefficients is of magnitude greater than
+ * @return 1 if one of the reflection coefficients is greater than
  *         4095, 0 if not.
  */
 static int eval_refl(int *refl, const int16_t *coefs, RA144Context *ractx)
@@ -265,14 +265,14 @@ static int interp(RA144Context *ractx, int16_t *out, int a,
     int b = NBLOCKS - a;
     int i;
 
-    // Interpolate block coefficients from the this frame forth block and
-    // last frame forth block
+    // Interpolate block coefficients from the this frame's forth block and
+    // last frame's forth block.
     for (i=0; i<30; i++)
         out[i] = (a * ractx->lpc_coef[0][i] + b * ractx->lpc_coef[1][i])>> 2;
 
     if (eval_refl(work, out, ractx)) {
         // The interpolated coefficients are unstable, copy either new or old
-        // coefficients
+        // coefficients.
         int_to_int16(out, ractx->lpc_coef[copyold]);
         return rescale_rms(ractx->lpc_refl_rms[copyold], energy);
     } else {
@@ -280,7 +280,7 @@ static int interp(RA144Context *ractx, int16_t *out, int a,
     }
 }
 
-/** Uncompress one block (20 bytes -> 160*2 bytes) */
+/** Uncompress one block (20 bytes -> 160*2 bytes). */
 static int ra144_decode_frame(AVCodecContext * avctx, void *vdata,
                               int *data_size, const uint8_t *buf, int buf_size)
 {