From: Roberto Togni <r_togni@tiscali.it>
Date: Tue, 6 Dec 2005 17:42:16 +0000 (+0000)
Subject: Support for samples with fft_order = 7
X-Git-Tag: v0.5~13433
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a4893bafd8b303c7933c2f4badedcf95d088c212;p=platform%2Fupstream%2Flibav.git

Support for samples with fft_order = 7
Fail init for unknown fft order, to prevent an array overflow
Output sound high-pitched compared to binary. Sample here
http://a1862.g.akamai.net/7/1862/14448/v1/esa.download.akamai.com/13452/qt/ESA_VenusExpress_110K_Stream.mov

Originally committed as revision 4724 to svn://svn.ffmpeg.org/ffmpeg/trunk
---

diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index f385077..d0a41f4 100644
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -1876,10 +1876,7 @@ static int qdm2_decode_init(AVCodecContext *avctx)
     s->group_order = av_log2(s->group_size) + 1;
     s->frame_size = s->group_size / 16; // 16 iterations per super block
 
-    if (s->fft_order == 8)
-        s->sub_sampling = 1;
-    else
-        s->sub_sampling = 2;
+    s->sub_sampling = s->fft_order - 7;
     s->frequency_range = 255 / (1 << (2 - s->sub_sampling));
     
     switch ((s->sub_sampling * 2 + s->channels - 1)) {
@@ -1899,11 +1896,11 @@ static int qdm2_decode_init(AVCodecContext *avctx)
     s->cm_table_select = tmp_val;
 
     if (s->sub_sampling == 0)
-        tmp = 16000;
+        tmp = 7999;
     else
         tmp = ((-(s->sub_sampling -1)) & 8000) + 20000;
     /*
-    0: 16000 -> 1
+    0: 7999 -> 0
     1: 20000 -> 2
     2: 28000 -> 2
     */
@@ -1914,8 +1911,11 @@ static int qdm2_decode_init(AVCodecContext *avctx)
     else
         s->coeff_per_sb_select = 2;
 
-    if (s->fft_order != 8 && s->fft_order != 9)
+    // Fail on unknown fft order, if it's > 9 it can overflow s->exptab[]
+    if ((s->fft_order < 7) || (s->fft_order > 9)) {
         av_log(avctx, AV_LOG_ERROR, "Unknown FFT order (%d), contact the developers!\n", s->fft_order);
+        return -1;
+    }
 
     ff_fft_init(&s->fft_ctx, s->fft_order - 1, 1);