MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/aacenc: Check all coefficients for finiteness

Browse Source 
This is needed as near infinite values on the input side result in only some
output to be non finite.
Also it may still be insufficient if subsequent computations overflow

Fixes null pointer dereference
Fixes: ae66c0f6c12ac1cd5c2c237031240f57/signal_sigsegv_2618c99_9516_6007026f2185a26d7afea895fbed6e38.ogg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Claudio Freire <klaussfreire@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-01-20 15:05:38 +01:00
parent 984d58a344
commit 2cb8edea7c
1 changed files with 6 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
libavcodec/aacenc.c
View File

@ -544,6 +544,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
chans = tag == TYPE_CPE ? 2 : 1;
cpe = &s->cpe[i];
for (ch = 0; ch < chans; ch++) {
int k;
float clip_avoidance_factor;
sce = &cpe->ch[ch];
ics = &sce->ics;
@ -607,17 +608,11 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
s->mdct1024.mdct_calc(&s->mdct1024, sce->lcoeffs, sce->ret_buf);
}
if (!(isfinite(cpe->ch[ch].coeffs[ 0]) &&
isfinite(cpe->ch[ch].coeffs[ 128]) &&
isfinite(cpe->ch[ch].coeffs[2*128]) &&
isfinite(cpe->ch[ch].coeffs[3*128]) &&
isfinite(cpe->ch[ch].coeffs[4*128]) &&
isfinite(cpe->ch[ch].coeffs[5*128]) &&
isfinite(cpe->ch[ch].coeffs[6*128]) &&
isfinite(cpe->ch[ch].coeffs[7*128]))
) {
av_log(avctx, AV_LOG_ERROR, "Input contains NaN/+-Inf\n");
return AVERROR(EINVAL);
for (k = 0; k < 1024; k++) {
if (!isfinite(cpe->ch[ch].coeffs[k])) {
av_log(avctx, AV_LOG_ERROR, "Input contains NaN/+-Inf\n");
return AVERROR(EINVAL);
}
}
avoid_clipping(s, sce);
}