On 26.01.2016 23:33, Paul B Mahol wrote:
> On 1/26/16, Andreas Cadhalpun <andreas.cadhal...@googlemail.com> wrote:
>> On 26.01.2016 23:17, Paul B Mahol wrote:
>>> ffmpeg | branch: master | Paul B Mahol <one...@gmail.com> | Mon Jan 25
>>> 21:54:17 2016 +0100| [e9e623369d7ba330ab8157157e956cb71d8058b5] |
>>> committer: Paul B Mahol
>>>
>>> avcodec: add Ulead DV audio decoder
>>>
>>> Fixes #1564.
>>>
>>> Signed-off-by: Paul B Mahol <one...@gmail.com>
>>
>> Leaving a little bit more time for review would have been nice.
>>
>>> diff --git a/libavcodec/dvaudiodec.c b/libavcodec/dvaudiodec.c
>>> new file mode 100644
>>> index 0000000..84db509
>>> --- /dev/null
>>> +++ b/libavcodec/dvaudiodec.c
>>> @@ -0,0 +1,144 @@
>> [...]
>>> +static int decode_frame(AVCodecContext *avctx, void *data,
>>> + int *got_frame_ptr, AVPacket *pkt)
>>> +{
>>> + DVAudioContext *s = avctx->priv_data;
>>> + AVFrame *frame = data;
>>> + const uint8_t *src = pkt->data;
>>> + int16_t *dst;
>>> + int ret, i;
>>> +
>>> + if (pkt->size != s->block_size)
>>> + return AVERROR_INVALIDDATA;
>>> +
>>> + frame->nb_samples = dv_get_audio_sample_count(pkt->data + 244,
>>> s->is_pal);
>>> + if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
>>> + return ret;
>>> + dst = (int16_t *)frame->data[0];
>>> +
>>> + for (i = 0; i < frame->nb_samples; i++) {
>>
>> Maybe this should be 'i < frame->nb_samples / 2'?
>
> Nope.
>
>>
>>> + const uint8_t *v = &src[s->shuffle[i]];
>>> +
>>> + if (s->is_12bit) {
>>> + *dst++ = dv_audio_12to16((v[0] << 4) | ((v[2] >> 4) & 0x0f));
>>> + *dst++ = dv_audio_12to16((v[1] << 4) | ((v[2] >> 0) & 0x0f));
>>> + } else {
>>> + *dst++ = AV_RB16(&v[0]);
>>
>> Because otherwise this can cause out of bounds writes.
>
> Audio is always stereo.
Thanks for quickly pushing a fix.
Best regards,
Andreas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
