[libav-devel] [PATCH] dca: prevent accessing static arrays with invalid indexes.

[Ronald S. Bultje]

From: "Ronald S. Bultje" <rsbul...@gmail.com>

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-sta...@libav.org
---
 libavcodec/dca.c     |   31 ++++++++++++++++++++++---------
 libavcodec/dcadata.h |    2 +-
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/libavcodec/dca.c b/libavcodec/dca.c
index 3f62c1e..381087a 100644
--- a/libavcodec/dca.c
+++ b/libavcodec/dca.c
@@ -718,15 +718,18 @@ static int dca_subframe_header(DCAContext *s, int 
base_channel, int block_index)
 
     for (j = base_channel; j < s->prim_channels; j++) {
         const uint32_t *scale_table;
-        int scale_sum;
+        int scale_sum, log_size;
 
         memset(s->scale_factor[j], 0,
                s->subband_activity[j] * sizeof(s->scale_factor[0][0][0]) * 2);
 
-        if (s->scalefactor_huffman[j] == 6)
+        if (s->scalefactor_huffman[j] == 6) {
             scale_table = scale_factor_quant7;
-        else
+            log_size = 7;
+        } else {
             scale_table = scale_factor_quant6;
+            log_size = 6;
+        }
 
         /* When huffman coded, only the difference is encoded */
         scale_sum = 0;
@@ -734,13 +737,13 @@ static int dca_subframe_header(DCAContext *s, int 
base_channel, int block_index)
         for (k = 0; k < s->subband_activity[j]; k++) {
             if (k >= s->vq_start_subband[j] || s->bitalloc[j][k] > 0) {
                 scale_sum = get_scale(&s->gb, s->scalefactor_huffman[j], 
scale_sum);
-                s->scale_factor[j][k][0] = scale_table[scale_sum];
+                s->scale_factor[j][k][0] = 
scale_table[av_clip_uintp2(scale_sum, log_size)];
             }
 
             if (k < s->vq_start_subband[j] && s->transition_mode[j][k]) {
                 /* Get second scale factor */
                 scale_sum = get_scale(&s->gb, s->scalefactor_huffman[j], 
scale_sum);
-                s->scale_factor[j][k][1] = scale_table[scale_sum];
+                s->scale_factor[j][k][1] = 
scale_table[av_clip_uintp2(scale_sum, log_size)];
             }
         }
     }
@@ -790,9 +793,17 @@ static int dca_subframe_header(DCAContext *s, int 
base_channel, int block_index)
             }
         } else {
             int am = s->amode & DCA_CHANNEL_MASK;
-            for (j = base_channel; j < s->prim_channels; j++) {
-                s->downmix_coef[j][0] = dca_default_coeffs[am][j][0];
-                s->downmix_coef[j][1] = dca_default_coeffs[am][j][1];
+            if (am < FF_ARRAY_ELEMS(dca_default_coeffs)) {
+                for (j = base_channel; j < s->prim_channels; j++) {
+                    s->downmix_coef[j][0] = dca_default_coeffs[am][j][0];
+                    s->downmix_coef[j][1] = dca_default_coeffs[am][j][1];
+                }
+            } else {
+                av_log_missing_feature(s->avctx, "non-standard channel mask 
value", 1);
+                for (j = base_channel; j < s->prim_channels; j++) {
+                    s->downmix_coef[j][0] = 0;
+                    s->downmix_coef[j][1] = 0;
+                }
             }
         }
     }
@@ -822,6 +833,7 @@ static int dca_subframe_header(DCAContext *s, int 
base_channel, int block_index)
         int lfe_samples = 2 * s->lfe * (4 + block_index);
         int lfe_end_sample = 2 * s->lfe * (4 + block_index + 
s->subsubframes[s->current_subframe]);
         float lfe_scale;
+        int idx;
 
         for (j = lfe_samples; j < lfe_end_sample; j++) {
             /* Signed 8 bits int */
@@ -829,7 +841,8 @@ static int dca_subframe_header(DCAContext *s, int 
base_channel, int block_index)
         }
 
         /* Scale factor index */
-        s->lfe_scale_factor = scale_factor_quant7[get_bits(&s->gb, 8)];
+        idx = get_bits(&s->gb, 8);
+        s->lfe_scale_factor = scale_factor_quant7[FFMIN(idx, 127)];
 
         /* Quantization step size * scale factor */
         lfe_scale = 0.035 * s->lfe_scale_factor;
diff --git a/libavcodec/dcadata.h b/libavcodec/dcadata.h
index 0a83cdf..4b58ef7 100644
--- a/libavcodec/dcadata.h
+++ b/libavcodec/dcadata.h
@@ -7528,7 +7528,7 @@ static const float dca_downmix_coeffs[65] = {
   0.001412537544623, 0.001000000000000, 0.000501187233627, 0.000251188643151, 
0.000000000000000,
 };
 
-static const uint8_t dca_default_coeffs[16][5][2] = {
+static const uint8_t dca_default_coeffs[10][5][2] = {
     { { 13, 13 },                                                 },
     { {  0, 64 }, { 64,  0 },                                     },
     { {  0, 64 }, { 64,  0 },                                     },
-- 
1.7.7.4

_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel