Commit 2cb8edea authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/aacenc: Check all coefficients for finiteness

This is needed as near infinite values on the input side result in only some
output to be non finite.
Also it may still be insufficient if subsequent computations overflow

Fixes null pointer dereference
Fixes: ae66c0f6c12ac1cd5c2c237031240f57/signal_sigsegv_2618c99_9516_6007026f2185a26d7afea895fbed6e38.ogg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: 's avatarClaudio Freire <klaussfreire@gmail.com>
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 984d58a3
......@@ -544,6 +544,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
chans = tag == TYPE_CPE ? 2 : 1;
cpe = &s->cpe[i];
for (ch = 0; ch < chans; ch++) {
int k;
float clip_avoidance_factor;
sce = &cpe->ch[ch];
ics = &sce->ics;
......@@ -607,18 +608,12 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
s->mdct1024.mdct_calc(&s->mdct1024, sce->lcoeffs, sce->ret_buf);
}
if (!(isfinite(cpe->ch[ch].coeffs[ 0]) &&
isfinite(cpe->ch[ch].coeffs[ 128]) &&
isfinite(cpe->ch[ch].coeffs[2*128]) &&
isfinite(cpe->ch[ch].coeffs[3*128]) &&
isfinite(cpe->ch[ch].coeffs[4*128]) &&
isfinite(cpe->ch[ch].coeffs[5*128]) &&
isfinite(cpe->ch[ch].coeffs[6*128]) &&
isfinite(cpe->ch[ch].coeffs[7*128]))
) {
for (k = 0; k < 1024; k++) {
if (!isfinite(cpe->ch[ch].coeffs[k])) {
av_log(avctx, AV_LOG_ERROR, "Input contains NaN/+-Inf\n");
return AVERROR(EINVAL);
}
}
avoid_clipping(s, sce);
}
start_ch += chans;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment