Merge remote-tracking branch 'qatar/master'

[ffmpeg.git] / libavcodec / qdm2.c

diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index 8d33e26..921f322 100644 (file)
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -5,20 +5,20 @@
  * Copyright (c) 2005 Alex Beregszaszi
  * Copyright (c) 2005 Roberto Togni
  *
  * Copyright (c) 2005 Alex Beregszaszi
  * Copyright (c) 2005 Roberto Togni
  *

- * This file is part of Libav.
+ * This file is part of FFmpeg.

  *
  *

- * Libav is free software; you can redistribute it and/or
+ * FFmpeg is free software; you can redistribute it and/or

  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *

- * Libav is distributed in the hope that it will be useful,
+ * FFmpeg is distributed in the hope that it will be useful,

  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public

- * License along with Libav; if not, write to the Free Software
+ * License along with FFmpeg; if not, write to the Free Software

  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 


@@ -168,7 +168,7 @@ typedef struct {
     /// I/O data
     const uint8_t *compressed_data;
     int compressed_size;
     /// I/O data
     const uint8_t *compressed_data;
     int compressed_size;

-    float output_buffer[QDM2_MAX_FRAME_SIZE * 2];
+    float output_buffer[QDM2_MAX_FRAME_SIZE * MPA_MAX_CHANNELS * 2];

 
     /// Synthesis filter
     MPADSPContext mpadsp;
 
     /// Synthesis filter
     MPADSPContext mpadsp;


@@ -375,7 +375,14 @@ static int qdm2_get_vlc(GetBitContext *gb, VLC *vlc, int flag, int depth)
 
     /* stage-3, optional */
     if (flag) {
 
     /* stage-3, optional */
     if (flag) {

-        int tmp = vlc_stage3_values[value];
+        int tmp;
+
+        if (value >= 60) {
+            av_log(NULL, AV_LOG_ERROR, "value %d in qdm2_get_vlc too large\n", value);
+            return 0;
+        }
+
+        tmp= vlc_stage3_values[value];

 
         if ((value & ~3) > 0)
             tmp += get_bits(gb, (value >> 2));
 
         if ((value & ~3) > 0)
             tmp += get_bits(gb, (value >> 2));


@@ -694,7 +701,8 @@ static void fill_coding_method_array(sb_int8_array tone_level_idx,
 
     if (!superblocktype_2_3) {
         /* This case is untested, no samples available */
 
     if (!superblocktype_2_3) {
         /* This case is untested, no samples available */

-        SAMPLES_NEEDED
+        avpriv_request_sample(NULL, "!superblocktype_2_3");
+        return;

         for (ch = 0; ch < nb_channels; ch++)
             for (sb = 0; sb < 30; sb++) {
                 for (j = 1; j < 63; j++) {  // The loop only iterates to 63 so the code doesn't overflow the buffer
         for (ch = 0; ch < nb_channels; ch++)
             for (sb = 0; sb < 30; sb++) {
                 for (j = 1; j < 63; j++) {  // The loop only iterates to 63 so the code doesn't overflow the buffer


@@ -730,7 +738,7 @@ static void fill_coding_method_array(sb_int8_array tone_level_idx,
                     for (j = 0; j < 64; j++)
                         acc += tone_level_idx_temp[ch][sb][j];
 
                     for (j = 0; j < 64; j++)
                         acc += tone_level_idx_temp[ch][sb][j];
 

-            multres = 0x66666667 * (acc * 10);
+            multres = 0x66666667LL * (acc * 10);

             esp_40 = (multres >> 32) / 8 + ((multres & 0xffffffff) >> 31);
             for (ch = 0;  ch < nb_channels; ch++)
                 for (sb = 0; sb < 30; sb++)
             esp_40 = (multres >> 32) / 8 + ((multres & 0xffffffff) >> 31);
             for (ch = 0;  ch < nb_channels; ch++)
                 for (sb = 0; sb < 30; sb++)


@@ -806,7 +814,7 @@ static void fill_coding_method_array(sb_int8_array tone_level_idx,
  * @param sb_min    lower subband processed (sb_min included)
  * @param sb_max    higher subband processed (sb_max excluded)
  */
  * @param sb_min    lower subband processed (sb_min included)
  * @param sb_max    higher subband processed (sb_max excluded)
  */

-static void synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb,
+static int synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb,

                                        int length, int sb_min, int sb_max)
 {
     int sb, j, k, n, ch, run, channels;
                                        int length, int sb_min, int sb_max)
 {
     int sb, j, k, n, ch, run, channels;


@@ -821,7 +829,7 @@ static void synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb,
         for (sb=sb_min; sb < sb_max; sb++)
             build_sb_samples_from_noise (q, sb);
 
         for (sb=sb_min; sb < sb_max; sb++)
             build_sb_samples_from_noise (q, sb);
 

-        return;
+        return 0;

     }
 
     for (sb = sb_min; sb < sb_max; sb++) {
     }
 
     for (sb = sb_min; sb < sb_max; sb++) {


@@ -845,6 +853,7 @@ static void synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb,
 
             if (fix_coding_method_array(sb, q->nb_channels,
                                             q->coding_method)) {
 
             if (fix_coding_method_array(sb, q->nb_channels,
                                             q->coding_method)) {

+                av_log(NULL, AV_LOG_ERROR, "coding method invalid\n");

                 build_sb_samples_from_noise(q, sb);
                 continue;
             }
                 build_sb_samples_from_noise(q, sb);
                 continue;
             }


@@ -869,6 +878,11 @@ static void synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb,
                                 }
                             } else {
                                 n = get_bits(gb, 8);
                                 }
                             } else {
                                 n = get_bits(gb, 8);

+                                if (n >= 243) {
+                                    av_log(NULL, AV_LOG_ERROR, "Invalid 8bit codeword\n");
+                                    return AVERROR_INVALIDDATA;
+                                }
+

                                 for (k = 0; k < 5; k++)
                                     samples[2 * k] = dequant_1bit[joined_stereo][random_dequant_index[n][k]];
                             }
                                 for (k = 0; k < 5; k++)
                                     samples[2 * k] = dequant_1bit[joined_stereo][random_dequant_index[n][k]];
                             }


@@ -905,6 +919,11 @@ static void synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb,
                                 }
                             } else {
                                 n = get_bits (gb, 8);
                                 }
                             } else {
                                 n = get_bits (gb, 8);

+                                if (n >= 243) {
+                                    av_log(NULL, AV_LOG_ERROR, "Invalid 8bit codeword\n");
+                                    return AVERROR_INVALIDDATA;
+                                }
+

                                 for (k = 0; k < 5; k++)
                                     samples[k] = dequant_1bit[joined_stereo][random_dequant_index[n][k]];
                             }
                                 for (k = 0; k < 5; k++)
                                     samples[k] = dequant_1bit[joined_stereo][random_dequant_index[n][k]];
                             }


@@ -918,6 +937,11 @@ static void synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb,
                     case 24:
                         if (get_bits_left(gb) >= 7) {
                             n = get_bits(gb, 7);
                     case 24:
                         if (get_bits_left(gb) >= 7) {
                             n = get_bits(gb, 7);

+                            if (n >= 125) {
+                                av_log(NULL, AV_LOG_ERROR, "Invalid 7bit codeword\n");
+                                return AVERROR_INVALIDDATA;
+                            }
+

                             for (k = 0; k < 3; k++)
                                 samples[k] = (random_dequant_type24[n][k] - 2.0) * 0.5;
                         } else {
                             for (k = 0; k < 3; k++)
                                 samples[k] = (random_dequant_type24[n][k] - 2.0) * 0.5;
                         } else {


@@ -930,10 +954,11 @@ static void synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb,
                     case 30:
                         if (get_bits_left(gb) >= 4) {
                             unsigned index = qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1);
                     case 30:
                         if (get_bits_left(gb) >= 4) {
                             unsigned index = qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1);

-                            if (index < FF_ARRAY_ELEMS(type30_dequant)) {
-                                samples[0] = type30_dequant[index];
-                            } else
-                                samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
+                            if (index >= FF_ARRAY_ELEMS(type30_dequant)) {
+                                av_log(NULL, AV_LOG_ERROR, "index %d out of type30_dequant array\n", index);
+                                return AVERROR_INVALIDDATA;
+                            }
+                            samples[0] = type30_dequant[index];

                         } else
                             samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
 
                         } else
                             samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
 


@@ -949,11 +974,12 @@ static void synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb,
                                 type34_first = 0;
                             } else {
                                 unsigned index = qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1);
                                 type34_first = 0;
                             } else {
                                 unsigned index = qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1);

-                                if (index < FF_ARRAY_ELEMS(type34_delta)) {
-                                    samples[0] = type34_delta[index] / type34_div + type34_predictor;
-                                    type34_predictor = samples[0];
-                                } else
-                                    samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
+                                if (index >= FF_ARRAY_ELEMS(type34_delta)) {
+                                    av_log(NULL, AV_LOG_ERROR, "index %d out of type34_delta array\n", index);
+                                    return AVERROR_INVALIDDATA;
+                                }
+                                samples[0] = type34_delta[index] / type34_div + type34_predictor;
+                                type34_predictor = samples[0];

                             }
                         } else {
                             samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);
                             }
                         } else {
                             samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);


@@ -990,6 +1016,7 @@ static void synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb,
             } // j loop
         } // channel loop
     } // subband loop
             } // j loop
         } // channel loop
     } // subband loop

+    return 0;

 }
 
 /**
 }
 
 /**


@@ -1002,24 +1029,27 @@ static void synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb,
  * @param quantized_coeffs    pointer to quantized_coeffs[ch][0]
  * @param gb        bitreader context
  */
  * @param quantized_coeffs    pointer to quantized_coeffs[ch][0]
  * @param gb        bitreader context
  */

-static void init_quantized_coeffs_elem0(int8_t *quantized_coeffs,
+static int init_quantized_coeffs_elem0(int8_t *quantized_coeffs,

                                         GetBitContext *gb)
 {
     int i, k, run, level, diff;
 
     if (get_bits_left(gb) < 16)
                                         GetBitContext *gb)
 {
     int i, k, run, level, diff;
 
     if (get_bits_left(gb) < 16)

-        return;
+        return -1;

     level = qdm2_get_vlc(gb, &vlc_tab_level, 0, 2);
 
     quantized_coeffs[0] = level;
 
     for (i = 0; i < 7; ) {
         if (get_bits_left(gb) < 16)
     level = qdm2_get_vlc(gb, &vlc_tab_level, 0, 2);
 
     quantized_coeffs[0] = level;
 
     for (i = 0; i < 7; ) {
         if (get_bits_left(gb) < 16)

-            break;
+            return -1;

         run = qdm2_get_vlc(gb, &vlc_tab_run, 0, 1) + 1;
 
         run = qdm2_get_vlc(gb, &vlc_tab_run, 0, 1) + 1;
 

+        if (i + run >= 8)
+            return -1;
+

         if (get_bits_left(gb) < 16)
         if (get_bits_left(gb) < 16)

-            break;
+            return -1;

         diff = qdm2_get_se_vlc(&vlc_tab_diff, gb, 2);
 
         for (k = 1; k <= run; k++)
         diff = qdm2_get_se_vlc(&vlc_tab_diff, gb, 2);
 
         for (k = 1; k <= run; k++)


@@ -1028,6 +1058,7 @@ static void init_quantized_coeffs_elem0(int8_t *quantized_coeffs,
         level += diff;
         i += run;
     }
         level += diff;
         i += run;
     }

+    return 0;

 }
 
 /**
 }
 
 /**


@@ -1102,7 +1133,7 @@ static void init_tone_level_dequantization (QDM2Context *q, GetBitContext *gb)
  * @param q       context
  * @param node    pointer to node with packet
  */
  * @param q       context
  * @param node    pointer to node with packet
  */

-static void process_subpacket_9(QDM2Context *q, QDM2SubPNode *node)
+static int process_subpacket_9(QDM2Context *q, QDM2SubPNode *node)

 {
     GetBitContext gb;
     int i, j, k, n, ch, run, level, diff;
 {
     GetBitContext gb;
     int i, j, k, n, ch, run, level, diff;


@@ -1120,6 +1151,9 @@ static void process_subpacket_9(QDM2Context *q, QDM2SubPNode *node)
                 run  = qdm2_get_vlc(&gb, &vlc_tab_run, 0, 1) + 1;
                 diff = qdm2_get_se_vlc(&vlc_tab_diff, &gb, 2);
 
                 run  = qdm2_get_vlc(&gb, &vlc_tab_run, 0, 1) + 1;
                 diff = qdm2_get_se_vlc(&vlc_tab_diff, &gb, 2);
 

+                if (j + run >= 8)
+                    return -1;
+

                 for (k = 1; k <= run; k++)
                     q->quantized_coeffs[ch][i][j + k] = (level + ((k * diff) / run));
 
                 for (k = 1; k <= run; k++)
                     q->quantized_coeffs[ch][i][j + k] = (level + ((k * diff) / run));
 


@@ -1131,6 +1165,8 @@ static void process_subpacket_9(QDM2Context *q, QDM2SubPNode *node)
     for (ch = 0; ch < q->nb_channels; ch++)
         for (i = 0; i < 8; i++)
             q->quantized_coeffs[ch][0][i] = 0;
     for (ch = 0; ch < q->nb_channels; ch++)
         for (i = 0; i < 8; i++)
             q->quantized_coeffs[ch][0][i] = 0;

+
+    return 0;

 }
 
 /**
 }
 
 /**


@@ -1200,7 +1236,7 @@ static void process_subpacket_12(QDM2Context *q, QDM2SubPNode *node)
     synthfilt_build_sb_samples(q, &gb, length, 8, QDM2_SB_USED(q->sub_sampling));
 }
 
     synthfilt_build_sb_samples(q, &gb, length, 8, QDM2_SB_USED(q->sub_sampling));
 }
 

-/*
+/**

  * Process new subpackets for synthesis filter
  *
  * @param q       context
  * Process new subpackets for synthesis filter
  *
  * @param q       context


@@ -1233,7 +1269,7 @@ static void process_synthesis_subpackets(QDM2Context *q, QDM2SubPNode *list)
         process_subpacket_12(q, NULL);
 }
 
         process_subpacket_12(q, NULL);
 }
 

-/*
+/**

  * Decode superblock, fill packet lists.
  *
  * @param q    context
  * Decode superblock, fill packet lists.
  *
  * @param q    context


@@ -1393,9 +1429,14 @@ static void qdm2_fft_decode_tones(QDM2Context *q, int duration,
     local_int_10 = 1 << (q->group_order - duration - 1);
     offset       = 1;
 
     local_int_10 = 1 << (q->group_order - duration - 1);
     offset       = 1;
 

-    while (1) {
+    while (get_bits_left(gb)>0) {

         if (q->superblocktype_2_3) {
             while ((n = qdm2_get_vlc(gb, &vlc_tab_fft_tone_offset[local_int_8], 1, 2)) < 2) {
         if (q->superblocktype_2_3) {
             while ((n = qdm2_get_vlc(gb, &vlc_tab_fft_tone_offset[local_int_8], 1, 2)) < 2) {

+                if (get_bits_left(gb)<0) {
+                    if(local_int_4 < q->group_size)
+                        av_log(NULL, AV_LOG_ERROR, "overread in qdm2_fft_decode_tones()\n");
+                    return;
+                }

                 offset = 1;
                 if (n == 0) {
                     local_int_4  += local_int_10;
                 offset = 1;
                 if (n == 0) {
                     local_int_4  += local_int_10;


@@ -1814,8 +1855,10 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
 
     avctx->channels = s->nb_channels = s->channels = AV_RB32(extradata);
     extradata += 4;
 
     avctx->channels = s->nb_channels = s->channels = AV_RB32(extradata);
     extradata += 4;

-    if (s->channels <= 0 || s->channels > MPA_MAX_CHANNELS)
+    if (s->channels <= 0 || s->channels > MPA_MAX_CHANNELS) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid number of channels\n");

         return AVERROR_INVALIDDATA;
         return AVERROR_INVALIDDATA;

+    }

     avctx->channel_layout = avctx->channels == 2 ? AV_CH_LAYOUT_STEREO :
                                                    AV_CH_LAYOUT_MONO;
 
     avctx->channel_layout = avctx->channels == 2 ? AV_CH_LAYOUT_STEREO :
                                                    AV_CH_LAYOUT_MONO;
 


@@ -1842,6 +1885,7 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
     // something like max decodable tones
     s->group_order = av_log2(s->group_size) + 1;
     s->frame_size = s->group_size / 16; // 16 iterations per super block
     // something like max decodable tones
     s->group_order = av_log2(s->group_size) + 1;
     s->frame_size = s->group_size / 16; // 16 iterations per super block

+

     if (s->frame_size > QDM2_MAX_FRAME_SIZE)
         return AVERROR_INVALIDDATA;
 
     if (s->frame_size > QDM2_MAX_FRAME_SIZE)
         return AVERROR_INVALIDDATA;
 


@@ -1864,18 +1908,9 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
     if ((tmp * 2240) < avctx->bit_rate)  tmp_val = 4;
     s->cm_table_select = tmp_val;
 
     if ((tmp * 2240) < avctx->bit_rate)  tmp_val = 4;
     s->cm_table_select = tmp_val;
 

-    if (s->sub_sampling == 0)
-        tmp = 7999;
-    else
-        tmp = ((-(s->sub_sampling -1)) & 8000) + 20000;
-    /*
-    0: 7999 -> 0
-    1: 20000 -> 2
-    2: 28000 -> 2
-    */
-    if (tmp < 8000)
+    if (avctx->bit_rate <= 8000)

         s->coeff_per_sb_select = 0;
         s->coeff_per_sb_select = 0;

-    else if (tmp <= 16000)
+    else if (avctx->bit_rate < 16000)

         s->coeff_per_sb_select = 1;
     else
         s->coeff_per_sb_select = 2;
         s->coeff_per_sb_select = 1;
     else
         s->coeff_per_sb_select = 2;


@@ -1912,6 +1947,9 @@ static int qdm2_decode(QDM2Context *q, const uint8_t *in, int16_t *out)
     int ch, i;
     const int frame_size = (q->frame_size * q->channels);
 
     int ch, i;
     const int frame_size = (q->frame_size * q->channels);
 

+    if((unsigned)frame_size > FF_ARRAY_ELEMS(q->output_buffer)/2)
+        return -1;
+

     /* select input buffer */
     q->compressed_data = in;
     q->compressed_size = q->checksum_size;
     /* select input buffer */
     q->compressed_data = in;
     q->compressed_size = q->checksum_size;


@@ -1983,10 +2021,8 @@ static int qdm2_decode_frame(AVCodecContext *avctx, void *data,
 
     /* get output buffer */
     frame->nb_samples = 16 * s->frame_size;
 
     /* get output buffer */
     frame->nb_samples = 16 * s->frame_size;

-    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {
-        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)

         return ret;
         return ret;

-    }

     out = (int16_t *)frame->data[0];
 
     for (i = 0; i < 16; i++) {
     out = (int16_t *)frame->data[0];
 
     for (i = 0; i < 16; i++) {