[FFmpeg-devel] [libav-devel] [PATCH] alac: validate k before using show_bits in decode_scalar

[Andreas Cadhalpun]

On 23.04.2015 22:06, Luca Barbato wrote:
> On 23/04/15 20:53, Andreas Cadhalpun wrote:
>> On 23.04.2015 16:37, Michael Niedermayer wrote:
>>> On Wed, Apr 22, 2015 at 06:24:54PM +0200, Andreas Cadhalpun wrote:
>>>> The k != 1 case calls show_bits(gb, k), which doesn't make sense if k
>>>> is 0.
>>>
>>> i dont think k = 0 is allowed
>>> i suggest you check rice_limit when it is set, i assume that is the
>>> source of k=0
>>> asking for a sample with rice_limit=0 if it occurs is also a good idea
>>
>> OK, new patch attached.
> 
> alac->rice_initial_history needs the same validation I guess.

I don't think so:
    alac->rice_initial_history = bytestream2_get_byteu(&gb);
...
    unsigned int history = alac->rice_initial_history;
...
        k = av_log2((history >> 9) + 3);
        k = FFMIN(k, alac->rice_limit);

So even if rice_initial_history is 0, k is not:
        k = av_log2(3) = 1

Best regards,
Andreas