Reimar Döffinger <[email protected]> added the comment: On Tue, Aug 25, 2009 at 04:13:39PM +0000, Kent Mein wrote: > > New submission from Kent Mein <[email protected]>: > > Another coverity issue: > CID: 443 > Checker: OVERRUN_STATIC (help) > File: base/src/extern/ffmpeg/libavcodec/dca.c > Function: dca_subsubframe > Description: Overrun of static array "(s)->subband_samples_hist[k][l]" of > size 4 > at position 10 with index variable "((m - n) + 4)" > > This is the following code: > 1003 if (m >= n) > 1004 subband_samples[k][l][m] += > 1005 (adpcm_vb[s->prediction_vq[k][l]][n - > 1] * > 1006 subband_samples[k][l][m - n] / 8192); > 1007 else if (s->predictor_history) > 1008 subband_samples[k][l][m] += > 1009 (adpcm_vb[s->prediction_vq[k][l]][n - > 1] * > 1010 s->subband_samples_hist[k][l][m - n + > 1011 4] / > 8192); > > This check is to make sure we do not have - index thats why the +4 however the > fix overruns at the top... > The following sample code shows the issue: > #include <stdio.h> > > int main() { > > int m,n; > > for (m = 0; m < 8; m++) { > for (n = 1; n <= 4; n++) { > printf("%d %d %d\n",m,n,m-n + 4); > } > } > return 1; > } > > Note: for m=7 and n = 1 m-n + 4 = 10 (which is bad because the array is > size 8)
The way I learned it 7 is >= 1, so m-n+4 never happens. Either you misunderstood coverity or coverity misunderstood the code. _____________________________________________________ FFmpeg issue tracker <[email protected]> <https://roundup.ffmpeg.org/roundup/ffmpeg/issue1340> _____________________________________________________
