[xiph-commits] r18183 - trunk/vorbis/lib

[xiphmont at svn.xiph.org]

Author: xiphmont
Date: 2012-02-03 12:51:27 -0800 (Fri, 03 Feb 2012)
New Revision: 18183

Modified:
   trunk/vorbis/lib/codebook.c
   trunk/vorbis/lib/floor0.c
Log:
Port r17546 from Tremor; although pieces had made it over to libvorbis, a comprehensive 
port and verification was called for.  This patch provided some additional floor0 
hardening:

  floor0 code could potentially use a book where the number of vals it
  needed to decode was not an integer number of dims wide.  This caused
  it to overflow the output vector as the termination condition was in
  the outer loop of vorbis_book_decodev_set.

  None of the various vorbis_book_decodeXXXX calls internally guard
  against this case either, but in every other use the calling code does
  properly guard (and avoids putting more checks in the tight inner
  decode loop).

  For floor0, move the checks into the inner loop as there's little
  penalty for doing so.

[an equivalent change was already in libvorbis, but I've 
harmonized the code with tremor]

  For floor0, move the checks into the inner loop as there's little
  penalty for doing so.  Add commentary indicating where guarding is
  done for each call variant.


 


Modified: trunk/vorbis/lib/codebook.c
===================================================================
--- trunk/vorbis/lib/codebook.c	2012-02-03 19:56:27 UTC (rev 18182)
+++ trunk/vorbis/lib/codebook.c	2012-02-03 20:51:27 UTC (rev 18183)
@@ -367,6 +367,7 @@
 }
 
 /* returns 0 on OK or -1 on eof *************************************/
+/* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodevs_add(codebook *book,float *a,oggpack_buffer *b,int n){
   if(book->used_entries>0){
     int step=n/book->dim;
@@ -386,6 +387,7 @@
   return(0);
 }
 
+/* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodev_add(codebook *book,float *a,oggpack_buffer *b,int n){
   if(book->used_entries>0){
     int i,j,entry;
@@ -431,6 +433,9 @@
   return(0);
 }
 
+/* unlike the others, we guard against n not being an integer number
+   of <dim> internally rather than in the upper layer (called only by
+   floor0) */
 long vorbis_book_decodev_set(codebook *book,float *a,oggpack_buffer *b,int n){
   if(book->used_entries>0){
     int i,j,entry;
@@ -440,15 +445,15 @@
       entry = decode_packed_entry_number(book,b);
       if(entry==-1)return(-1);
       t     = book->valuelist+entry*book->dim;
-      for (j=0;j<book->dim;)
+      for (j=0;i<n && j<book->dim;){
         a[i++]=t[j++];
+      }
     }
   }else{
     int i,j;
 
     for(i=0;i<n;){
-      for (j=0;j<book->dim;j++)
-        a[i++]=0.f;
+      a[i++]=0.f;
     }
   }
   return(0);

Modified: trunk/vorbis/lib/floor0.c
===================================================================
--- trunk/vorbis/lib/floor0.c	2012-02-03 19:56:27 UTC (rev 18182)
+++ trunk/vorbis/lib/floor0.c	2012-02-03 20:51:27 UTC (rev 18183)
@@ -177,10 +177,9 @@
          vector */
       float *lsp=_vorbis_block_alloc(vb,sizeof(*lsp)*(look->m+b->dim+1));
 
-      for(j=0;j<look->m;j+=b->dim)
-        if(vorbis_book_decodev_set(b,lsp+j,&vb->opb,b->dim)==-1)goto eop;
+      if(vorbis_book_decodev_set(b,lsp,&vb->opb,look->m,-24)==-1)goto eop;
       for(j=0;j<look->m;){
-        for(k=0;k<b->dim;k++,j++)lsp[j]+=last;
+        for(k=0;j<look->m && k<b->dim;k++,j++)lsp[j]+=last;
         last=lsp[j-1];
       }