Commit c86a9d5b authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/dstdec: Replace AC overread check by sample rate check

Real files do skip coding 0 bits at the end, thus this kind of check
does not work reliable.

Fixes: Ticket 8770
Fixes: dst-256fs44-6ch-refdstencoder.dff

The samplerate is specified in ISO/IEC 14496-3:2005(E) as one of 3 fixed
values, this also can be used to limit the duration and avoid the timeout

This reverts commit f6df99db.

(cherry picked from commit 1679f23beb3cfc3639352b3cbe7c08c00189c6b0)
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 1f32d8ea
...@@ -56,7 +56,6 @@ static const int8_t probs_code_pred_coeff[3][3] = { ...@@ -56,7 +56,6 @@ static const int8_t probs_code_pred_coeff[3][3] = {
typedef struct ArithCoder { typedef struct ArithCoder {
unsigned int a; unsigned int a;
unsigned int c; unsigned int c;
int overread;
} ArithCoder; } ArithCoder;
typedef struct Table { typedef struct Table {
...@@ -86,6 +85,12 @@ static av_cold int decode_init(AVCodecContext *avctx) ...@@ -86,6 +85,12 @@ static av_cold int decode_init(AVCodecContext *avctx)
return AVERROR_PATCHWELCOME; return AVERROR_PATCHWELCOME;
} }
// the sample rate is only allowed to be 64,128,256 * 44100 by ISO/IEC 14496-3:2005(E)
// We are a bit more tolerant here, but this check is needed to bound the size and duration
if (avctx->sample_rate > 512 * 44100)
return AVERROR_INVALIDDATA;
if (DST_SAMPLES_PER_FRAME(avctx->sample_rate) & 7) { if (DST_SAMPLES_PER_FRAME(avctx->sample_rate) & 7) {
return AVERROR_PATCHWELCOME; return AVERROR_PATCHWELCOME;
} }
...@@ -181,7 +186,6 @@ static void ac_init(ArithCoder *ac, GetBitContext *gb) ...@@ -181,7 +186,6 @@ static void ac_init(ArithCoder *ac, GetBitContext *gb)
{ {
ac->a = 4095; ac->a = 4095;
ac->c = get_bits(gb, 12); ac->c = get_bits(gb, 12);
ac->overread = 0;
} }
static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, int *e) static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, int *e)
...@@ -201,8 +205,6 @@ static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, in ...@@ -201,8 +205,6 @@ static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, in
if (ac->a < 2048) { if (ac->a < 2048) {
int n = 11 - av_log2(ac->a); int n = 11 - av_log2(ac->a);
ac->a <<= n; ac->a <<= n;
if (get_bits_left(gb) < n)
ac->overread ++;
ac->c = (ac->c << n) | get_bits(gb, n); ac->c = (ac->c << n) | get_bits(gb, n);
} }
} }
...@@ -355,9 +357,6 @@ static int decode_frame(AVCodecContext *avctx, void *data, ...@@ -355,9 +357,6 @@ static int decode_frame(AVCodecContext *avctx, void *data,
prob = 128; prob = 128;
} }
if (ac->overread > 16)
return AVERROR_INVALIDDATA;
ac_get(ac, gb, prob, &residual); ac_get(ac, gb, prob, &residual);
v = ((predict >> 15) ^ residual) & 1; v = ((predict >> 15) ^ residual) & 1;
dsd[((i >> 3) * channels + ch) << 2] |= v << (7 - (i & 0x7 )); dsd[((i >> 3) * channels + ch) << 2] |= v << (7 - (i & 0x7 ));
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment