[FFmpeg-cvslog] r22381 - trunk/libavcodec/aacsbr.c

[alexc]

Author: alexc
Date: Tue Mar  9 11:25:42 2010
New Revision: 22381

Log:
aacsbr: Fail early on illegal envelope counts.

Modified:
   trunk/libavcodec/aacsbr.c

Modified: trunk/libavcodec/aacsbr.c
==============================================================================
--- trunk/libavcodec/aacsbr.c	Tue Mar  9 10:27:11 2010	(r22380)
+++ trunk/libavcodec/aacsbr.c	Tue Mar  9 11:25:42 2010	(r22381)
@@ -628,6 +628,13 @@ static int read_sbr_grid(AACContext *ac,
         if (ch_data->bs_num_env[1] == 1)
             ch_data->bs_amp_res = 0;
 
+        if (ch_data->bs_num_env[1] > 4) {
+            av_log(ac->avccontext, AV_LOG_ERROR,
+                   "Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
+                   ch_data->bs_num_env[1]);
+            return -1;
+        }
+
         ch_data->bs_pointer = 0;
 
         ch_data->bs_freq_res[1] = get_bits1(gb);
@@ -666,6 +673,13 @@ static int read_sbr_grid(AACContext *ac,
         ch_data->bs_num_rel[1]  = get_bits(gb, 2);
         ch_data->bs_num_env[1]  = ch_data->bs_num_rel[0] + ch_data->bs_num_rel[1] + 1;
 
+        if (ch_data->bs_num_env[1] > 5) {
+            av_log(ac->avccontext, AV_LOG_ERROR,
+                   "Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n",
+                   ch_data->bs_num_env[1]);
+            return -1;
+        }
+
         for (i = 0; i < ch_data->bs_num_rel[0]; i++)
             ch_data->bs_rel_bord[0][i] = 2 * get_bits(gb, 2) + 2;
         for (i = 0; i < ch_data->bs_num_rel[1]; i++)
@@ -683,18 +697,6 @@ static int read_sbr_grid(AACContext *ac,
                ch_data->bs_pointer);
         return -1;
     }
-    if (ch_data->bs_frame_class == FIXFIX && ch_data->bs_num_env[1] > 4) {
-        av_log(ac->avccontext, AV_LOG_ERROR,
-               "Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
-               ch_data->bs_num_env[1]);
-        return -1;
-    }
-    if (ch_data->bs_frame_class == VARVAR && ch_data->bs_num_env[1] > 5) {
-        av_log(ac->avccontext, AV_LOG_ERROR,
-               "Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n",
-               ch_data->bs_num_env[1]);
-        return -1;
-    }
 
     ch_data->bs_num_noise = (ch_data->bs_num_env[1] > 1) + 1;