[xiph-commits] r17546 - trunk/Tremor

[xiphmont at svn.xiph.org]

Author: xiphmont
Date: 2010-10-18 02:54:48 -0700 (Mon, 18 Oct 2010)
New Revision: 17546

Modified:
   trunk/Tremor/codebook.c
   trunk/Tremor/floor0.c
Log:
floor0 code could potentially use a book where the number of vals it
needed to decode was not an integer number of dims wide.  This caused
it to overflow the output vector as the termination condition was in
the outer loop of vorbis_book_decodev_set.

None of the various vorbis_book_decodeXXXX calls internally guard
against this case either, but in every other use the calling code does
properly guard (and avoids putting more checks in the tight inner
decode loop).

For floor0, move the checks into the inner loop as there's little
penalty for doing so.  Add commentary indicating where guarding is
done for each call variant.




Modified: trunk/Tremor/codebook.c
===================================================================
--- trunk/Tremor/codebook.c	2010-10-18 09:54:02 UTC (rev 17545)
+++ trunk/Tremor/codebook.c	2010-10-18 09:54:48 UTC (rev 17546)
@@ -241,6 +241,7 @@
 }
 
 /* returns 0 on OK or -1 on eof *************************************/
+/* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodevs_add(codebook *book,ogg_int32_t *a,
 			      oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){  
@@ -273,6 +274,7 @@
   return(0);
 }
 
+/* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodev_add(codebook *book,ogg_int32_t *a,
 			     oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){
@@ -301,6 +303,9 @@
   return(0);
 }
 
+/* unlike the others, we guard against n not being an integer number
+   of <dim> internally rather than in the upper layer (called only by
+   floor0) */
 long vorbis_book_decodev_set(codebook *book,ogg_int32_t *a,
 			     oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){
@@ -314,7 +319,7 @@
 	entry = decode_packed_entry_number(book,b);
 	if(entry==-1)return(-1);
 	t     = book->valuelist+entry*book->dim;
-	for (j=0;j<book->dim;){
+	for (j=0;i<n && j<book->dim;){
 	  a[i++]=t[j++]>>shift;
 	}
       }
@@ -324,7 +329,7 @@
 	entry = decode_packed_entry_number(book,b);
 	if(entry==-1)return(-1);
 	t     = book->valuelist+entry*book->dim;
-	for (j=0;j<book->dim;){
+	for (j=0;i<n && j<book->dim;){
 	  a[i++]=t[j++]<<-shift;
 	}
       }
@@ -333,14 +338,13 @@
 
     int i,j;
     for(i=0;i<n;){
-      for (j=0;j<book->dim;){
-	a[i++]=0;
-      }
+      a[i++]=0;
     }
   }
   return(0);
 }
 
+/* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodevv_add(codebook *book,ogg_int32_t **a,\
 			      long offset,int ch,
 			      oggpack_buffer *b,int n,int point){

Modified: trunk/Tremor/floor0.c
===================================================================
--- trunk/Tremor/floor0.c	2010-10-18 09:54:02 UTC (rev 17545)
+++ trunk/Tremor/floor0.c	2010-10-18 09:54:48 UTC (rev 17546)
@@ -397,10 +397,9 @@
       ogg_int32_t last=0;
       ogg_int32_t *lsp=(ogg_int32_t *)_vorbis_block_alloc(vb,sizeof(*lsp)*(look->m+1));
             
-      for(j=0;j<look->m;j+=b->dim)
-	if(vorbis_book_decodev_set(b,lsp+j,&vb->opb,b->dim,-24)==-1)goto eop;
+      if(vorbis_book_decodev_set(b,lsp,&vb->opb,look->m,-24)==-1)goto eop;
       for(j=0;j<look->m;){
-	for(k=0;k<b->dim;k++,j++)lsp[j]+=last;
+	for(k=0;j<look->m && k<b->dim;k++,j++)lsp[j]+=last;
 	last=lsp[j-1];
       }