New submission from Kent Mein <[email protected]>:
Another coverity issue:
CID: 443
Checker: OVERRUN_STATIC (help)
File: base/src/extern/ffmpeg/libavcodec/dca.c
Function: dca_subsubframe
Description: Overrun of static array "(s)->subband_samples_hist[k][l]" of size 4
at position 10 with index variable "((m - n) + 4)"
This is the following code:
1003 if (m >= n)
1004 subband_samples[k][l][m] +=
1005 (adpcm_vb[s->prediction_vq[k][l]][n -
1] *
1006 subband_samples[k][l][m - n] / 8192);
1007 else if (s->predictor_history)
1008 subband_samples[k][l][m] +=
1009 (adpcm_vb[s->prediction_vq[k][l]][n -
1] *
1010 s->subband_samples_hist[k][l][m - n +
1011 4] /
8192);
This check is to make sure we do not have - index thats why the +4 however the
fix overruns at the top...
The following sample code shows the issue:
#include <stdio.h>
int main() {
int m,n;
for (m = 0; m < 8; m++) {
for (n = 1; n <= 4; n++) {
printf("%d %d %d\n",m,n,m-n + 4);
}
}
return 1;
}
Note: for m=7 and n = 1 m-n + 4 = 10 (which is bad because the array is size
8)
I haven't looked closely enough at the code to write a good fix, but feel free
to bug me if you want me to work on it...
I would guess changing the test for m >= n to
if ((m>4) || (m >= n)) would fix it but someone might want to look closer at
this...
----------
messages: 6750
priority: normal
status: new
substatus: new
title: over run of static array
type: bug
_____________________________________________________
FFmpeg issue tracker <[email protected]>
<https://roundup.ffmpeg.org/roundup/ffmpeg/issue1340>
_____________________________________________________
