On 03.01.2016 22:50, Michael Niedermayer wrote:
> On Sun, Jan 03, 2016 at 07:50:39PM +0100, Andreas Cadhalpun wrote:
>> vorbisdec.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>> ba151dadb72b6c74e1139decf4b32c8676ddc58e
>> 0001-vorbisdec-reject-rangebits-0.patch
>> From d740a59b6e099c90504d55c65923def1ad6de234 Mon Sep 17 00:00:00 2001
>> From: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
>> Date: Sun, 3 Jan 2016 19:11:24 +0100
>> Subject: [PATCH 1/2] vorbisdec: reject rangebits 0
>>
>> This causes non-unique elements in floor_setup->data.t1.list, which
>> makes the stream undecodable according to the specification.
>>
>> Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
>> ---
>> libavcodec/vorbisdec.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
>> index f773afa..2792af1 100644
>> --- a/libavcodec/vorbisdec.c
>> +++ b/libavcodec/vorbisdec.c
>> @@ -573,6 +573,11 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context
>> *vc)
>> return AVERROR(ENOMEM);
>>
>> rangebits = get_bits(gb, 4);
>> + if (!rangebits) {
>> + av_log(vc->avctx, AV_LOG_ERROR,
>> + "A rangebits value of 0 is not compliant with the
>> Vorbis I specification.\n");
>> + return AVERROR_INVALIDDATA;
>> + }
>
> this assumes partitions > 0
> iam not sure if this is required or not, the spec does not seem to
> explicitly state it
OK, so let's only error out if partitions is > 0.
Updated patch attached.
Best regards,
Andreas
>From 37170226888eb08fe1d98e31bed4a0a8199bd7e3 Mon Sep 17 00:00:00 2001
From: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
Date: Sun, 3 Jan 2016 19:11:24 +0100
Subject: [PATCH] vorbisdec: reject rangebits 0 with non-0 partitions
This causes non-unique elements in floor_setup->data.t1.list, which
makes the stream undecodable according to the specification.
Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
---
libavcodec/vorbisdec.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index f773afa..59691b9 100644
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -573,6 +573,11 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc)
return AVERROR(ENOMEM);
rangebits = get_bits(gb, 4);
+ if (!rangebits && floor_setup->data.t1.partitions) {
+ av_log(vc->avctx, AV_LOG_ERROR,
+ "A rangebits value of 0 is not compliant with the Vorbis I specification.\n");
+ return AVERROR_INVALIDDATA;
+ }
rangemax = (1 << rangebits);
if (rangemax > vc->blocksize[1] / 2) {
av_log(vc->avctx, AV_LOG_ERROR,
--
2.6.4
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
