X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fhcadec.c;h=9c3eda21afda77d48b57d5a2392b0ff4ffa4f4f3;hb=d40bb518b50561db60ef71ab0e37eb7f3fb9043b;hp=f25d6c39b66b3e1a60b9f4a88e83fea72ed2e45c;hpb=67de1865b1ee9e3616124b8fb6f1c34cba1b1d5f;p=ffmpeg

diff --git a/libavcodec/hcadec.c b/libavcodec/hcadec.c
index f25d6c39b66..9c3eda21afd 100644
--- a/libavcodec/hcadec.c
+++ b/libavcodec/hcadec.c
@@ -19,6 +19,7 @@
 #include "libavutil/crc.h"
 #include "libavutil/float_dsp.h"
 #include "libavutil/intreadwrite.h"
+#include "libavutil/mem_internal.h"
 #include "libavutil/tx.h"
 
 #include "avcodec.h"
@@ -157,6 +158,10 @@ static av_cold int decode_init(AVCodecContext *avctx)
     } else
         return AVERROR_INVALIDDATA;
 
+    if (c->total_band_count > FF_ARRAY_ELEMS(c->ch->imdct_in))
+        return AVERROR_INVALIDDATA;
+
+
     while (get_bits_left(gb) >= 32) {
         chunk = get_bits_long(gb, 32);
         if (chunk == MKBETAG('v', 'b', 'r', 0)) {
@@ -263,7 +268,7 @@ static void apply_intensity_stereo(HCAContext *s, ChannelContext *ch1, ChannelCo
                                    int index, unsigned band_count, unsigned base_band_count,
                                    unsigned stereo_band_count)
 {
-    float ratio_l = intensity_ratio_table[ch1->intensity[index]];
+    float ratio_l = intensity_ratio_table[ch2->intensity[index]];
     float ratio_r = ratio_l - 2.0f;
     float *c1 = &ch1->imdct_in[base_band_count];
     float *c2 = &ch2->imdct_in[base_band_count];
@@ -286,8 +291,9 @@ static void reconstruct_hfr(HCAContext *s, ChannelContext *ch,
         return;
 
     for (int i = 0, k = start_band, l = start_band - 1; i < hfr_group_count; i++){
-        for (int j = 0; j < bands_per_hfr_group && k < total_band_count; j++, k++, l--){
-            ch->imdct_in[k] = scale_conversion_table[ch->hfr_scale[i] - ch->scale_factors[l]] * ch->imdct_in[l];
+        for (int j = 0; j < bands_per_hfr_group && k < total_band_count && l >= 0; j++, k++, l--){
+            ch->imdct_in[k] = scale_conversion_table[ scale_conv_bias +
+                av_clip_intp2(ch->hfr_scale[i] - ch->scale_factors[l], 6) ] * ch->imdct_in[l];
         }
     }