Reimar Döffinger <[email protected]> added the comment:

On Tue, Aug 25, 2009 at 04:13:39PM +0000, Kent Mein wrote:
> 
> New submission from Kent Mein <[email protected]>:
> 
> Another coverity issue:
> CID: 443
> Checker: OVERRUN_STATIC (help)
> File: base/src/extern/ffmpeg/libavcodec/dca.c
> Function: dca_subsubframe
> Description: Overrun of static array "(s)->subband_samples_hist[k][l]" of 
> size 4
> at position 10 with index variable "((m - n) + 4)"
> 
> This is the following code:
> 1003                          if (m >= n)
> 1004                              subband_samples[k][l][m] +=
> 1005                                  (adpcm_vb[s->prediction_vq[k][l]][n - 
> 1] *
> 1006                                   subband_samples[k][l][m - n] / 8192);
> 1007                          else if (s->predictor_history)
> 1008                              subband_samples[k][l][m] +=
> 1009                                  (adpcm_vb[s->prediction_vq[k][l]][n - 
> 1] *
> 1010                                   s->subband_samples_hist[k][l][m - n +
> 1011                                                                 4] / 
> 8192);
> 
> This check is to make sure we do not have - index thats why the +4 however the
> fix overruns at the top...
> The following sample code shows the issue:
> #include <stdio.h>
> 
> int main() {
> 
>         int m,n;
> 
>         for (m = 0; m < 8; m++) {
>                 for (n = 1; n <= 4; n++) {
>                         printf("%d %d %d\n",m,n,m-n + 4);
>                 }
>         }
>         return 1;
> }
> 
> Note: for m=7 and n = 1  m-n + 4  = 10  (which is bad because the array is 
> size 8)

The way I learned it 7 is >= 1, so m-n+4 never happens.
Either you misunderstood coverity or coverity misunderstood the code.

_____________________________________________________
FFmpeg issue tracker <[email protected]>
<https://roundup.ffmpeg.org/roundup/ffmpeg/issue1340>
_____________________________________________________

Reply via email to