Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(67)

Side by Side Diff: source/patched-ffmpeg/libavcodec/vorbis.c

Issue 8365014: Avoid the possibility to read out-of-bounds of a static global array in Vorbis (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/deps/third_party/ffmpeg/
Patch Set: Created 9 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « patches/to_upstream/44_vorbis_oob_read.patch ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /** 1 /**
2 * @file 2 * @file
3 * Common code for Vorbis I encoder and decoder 3 * Common code for Vorbis I encoder and decoder
4 * @author Denes Balatoni ( dbalatoni programozo hu ) 4 * @author Denes Balatoni ( dbalatoni programozo hu )
5 * 5 *
6 * This file is part of FFmpeg. 6 * This file is part of FFmpeg.
7 * 7 *
8 * FFmpeg is free software; you can redistribute it and/or 8 * FFmpeg is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public 9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either 10 * License as published by the Free Software Foundation; either
(...skipping 132 matching lines...) Expand 10 before | Expand all | Expand 10 after
143 for (j = i + 1; j < values; j++) { 143 for (j = i + 1; j < values; j++) {
144 if (list[list[i].sort].x > list[list[j].sort].x) { 144 if (list[list[i].sort].x > list[list[j].sort].x) {
145 int tmp = list[i].sort; 145 int tmp = list[i].sort;
146 list[i].sort = list[j].sort; 146 list[i].sort = list[j].sort;
147 list[j].sort = tmp; 147 list[j].sort = tmp;
148 } 148 }
149 } 149 }
150 } 150 }
151 } 151 }
152 152
153 static inline void render_line_unrolled(intptr_t x, intptr_t y, int x1, 153 static inline void render_line_unrolled(intptr_t x, unsigned char y, int x1,
154 intptr_t sy, int ady, int adx, 154 intptr_t sy, int ady, int adx,
155 float *buf) 155 float *buf)
156 { 156 {
157 int err = -adx; 157 int err = -adx;
158 x -= x1 - 1; 158 x -= x1 - 1;
159 buf += x1 - 1; 159 buf += x1 - 1;
160 while (++x < 0) { 160 while (++x < 0) {
161 err += ady; 161 err += ady;
162 if (err >= 0) { 162 if (err >= 0) {
163 err += ady - adx; 163 err += ady - adx;
(...skipping 14 matching lines...) Expand all
178 int dy = y1 - y0; 178 int dy = y1 - y0;
179 int adx = x1 - x0; 179 int adx = x1 - x0;
180 int ady = FFABS(dy); 180 int ady = FFABS(dy);
181 int sy = dy < 0 ? -1 : 1; 181 int sy = dy < 0 ? -1 : 1;
182 buf[x0] = ff_vorbis_floor1_inverse_db_table[y0]; 182 buf[x0] = ff_vorbis_floor1_inverse_db_table[y0];
183 if (ady*2 <= adx) { // optimized common case 183 if (ady*2 <= adx) { // optimized common case
184 render_line_unrolled(x0, y0, x1, sy, ady, adx, buf); 184 render_line_unrolled(x0, y0, x1, sy, ady, adx, buf);
185 } else { 185 } else {
186 int base = dy / adx; 186 int base = dy / adx;
187 int x = x0; 187 int x = x0;
188 int y = y0; 188 unsigned char y = y0;
189 int err = -adx; 189 int err = -adx;
190 ady -= FFABS(base) * adx; 190 ady -= FFABS(base) * adx;
191 while (++x < x1) { 191 while (++x < x1) {
192 y += base; 192 y += base;
193 err += ady; 193 err += ady;
194 if (err >= 0) { 194 if (err >= 0) {
195 err -= adx; 195 err -= adx;
196 y += sy; 196 y += sy;
197 } 197 }
198 buf[x] = ff_vorbis_floor1_inverse_db_table[y]; 198 buf[x] = ff_vorbis_floor1_inverse_db_table[y];
(...skipping 17 matching lines...) Expand all
216 render_line(lx, ly, FFMIN(x1,samples), y1, out); 216 render_line(lx, ly, FFMIN(x1,samples), y1, out);
217 lx = x1; 217 lx = x1;
218 ly = y1; 218 ly = y1;
219 } 219 }
220 if (lx >= samples) 220 if (lx >= samples)
221 break; 221 break;
222 } 222 }
223 if (lx < samples) 223 if (lx < samples)
224 render_line(lx, ly, samples, ly, out); 224 render_line(lx, ly, samples, ly, out);
225 } 225 }
OLDNEW
« no previous file with comments | « patches/to_upstream/44_vorbis_oob_read.patch ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698