From patchwork Sat Dec 2 17:46:57 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew D'Addesio X-Patchwork-Id: 6511 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.2.161.94 with SMTP id m30csp2568297jah; Sat, 2 Dec 2017 09:47:44 -0800 (PST) X-Google-Smtp-Source: AGs4zMaHg/KGTmGKIk/vJJ7UfSBdI6V9SgIvMJm3+bJcCoB6g4ucDbAyp3n5MSVXvTq6hk000SUG X-Received: by 10.28.144.148 with SMTP id s142mr3692053wmd.82.1512236864099; Sat, 02 Dec 2017 09:47:44 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1512236864; cv=none; d=google.com; s=arc-20160816; b=MclHhRoz/oVSmcAquoyeNKOdlC6DwGsaxpWy9bTE2i0zF6lZ94iYBiuPEDN8+/Kyop 5/mISTKN+dFt7kLACVcBHWP+H5bvfvpMW0YmWYfcMhdwo9qH0MhNwLoaikmLZtK6Jcg9 jOHw4h05jUQ3TS95KOerLQ68OFPdNoT2MVfw9dJt/uZKaleTpskiyilWB6GTRF3GDla4 rCsMIA7hcEbZgcBihJEqjzuejXRHO6OrtlfNePVq6HSVWWTAFu8xBGhGnypcexem51+K SahlU5QnfaPBAM8VacDr2t03vgaUYP4NLeFABS8jETWe92R/bXsKEDkQ+NN1CUDueF+3 Rl6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:cc:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:dkim-signature:delivered-to:arc-authentication-results; bh=fVIBqJkMLnS1GgFdc0XFe5LjqCkJnu5VL+ulErNmipo=; b=a5JYWpRiQjsAj/w9BRPvzgF+WblYCEJVX5SgMNePFa16WXfd6qXQegbXDQv6fKNcMT 2Qz8Gu2GXCDG/C/NrRQYWLOvN5PTUeQXF1AJS+fmaWCPq65rMAi1/JAg4Bb5vw50eneQ EI5ttgBnSl8uTb8pCVCUT2Sjl6xGXID5DP7YMtzqfHoecaSa6QQA6x12jwQ1alhrKWHI iIejt750TCXFxeQKVucbmGhSJdP3yziJAoVhf9rCg+tzCJh2FQvOHMCrmD1UsyuMb2g9 dIIiPFJDrBWeVDVyeBS9nlkMv8/+U8iR8ORcx2iVbAoRETEBZGxKGwD/c2lbGr6DH42o g2SQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20161025 header.b=fXSMLfyx; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id p12si2400134wmh.135.2017.12.02.09.47.43; Sat, 02 Dec 2017 09:47:44 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20161025 header.b=fXSMLfyx; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id B3A0A68A54C; Sat, 2 Dec 2017 19:47:38 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-ot0-f195.google.com (mail-ot0-f195.google.com [74.125.82.195]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 81271689E67 for ; Sat, 2 Dec 2017 19:47:32 +0200 (EET) Received: by mail-ot0-f195.google.com with SMTP id d5so11603866oti.3 for ; Sat, 02 Dec 2017 09:47:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=8a2Io8wVoahHDyz+RdlPN5eJKqc4Z1MYaqJ1/47UlyE=; b=fXSMLfyxqRRUf14bxHxExND5GXa249hJETbd1watg67lDNn9LoR2qoh8JmE4mdnu8u d1Efd2D10czmeQK0TRpP260F4zboK2+wGjZVorc/K7fSM+J3fnsl7vAc3Shi5+z5pwb+ j6h7FDLMTdoG2ucs7wE0rdl+Omc/QE/xX/jssBWE44eF6ZYxOntzpbP9apTqsZSQlzSw yytZcB58m01bv6Pxwi2/M7gzRDaN/E+ANhwq/kJLfMPj3hpfb0wPnGcLpsVe6aZLtGIG Yq9Py8ie+ouayI1YmqpKJCfNC37zc1uLftG7cTr6+Sjl0Q4TwVigEaKjC72IiciQpVEC loTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=8a2Io8wVoahHDyz+RdlPN5eJKqc4Z1MYaqJ1/47UlyE=; b=X2t5P9Oec6+kuJOfohbIJM/9pEzWVICgcNH+cF1sn08CJFEkcsdRLpMSmYwgRP3MVx c1dAlXF3uQGeHyEPaZMW9+PYWvhVZ6OvXmrhILKFNdqKFq8DBvmUMoKHQIfWggVSGg9n XJhkbAV3BjcpVHHZYI9go87DlyDRrP1jerc4lOMAzi+VKmIZRRbvJiWGfN/YdKE3qiw7 io8TX3nzMxuJUWSHx3l00uHnWL5XiuNXWgg4LSKm0DhqBBG+dbFF3TGTX4sKKNbZRABP 1dEopm6IyMUG1ytcAQtrYrUJ6JdwYXf5jDckyAz/k22q/dMuMHcJingO00oPHT0PtnT/ 24IQ== X-Gm-Message-State: AJaThX5YFSo573rI77pcvFsdFeaOsyBIAspkzA1Fd7xdz1MmlcxUYAJs QiNtQhYz04zpIc8Gv86lcsTQLA== X-Received: by 10.157.43.167 with SMTP id u36mr11743463ota.287.1512236855264; Sat, 02 Dec 2017 09:47:35 -0800 (PST) Received: from localhost.localdomain ([2605:6000:1019:4a8:80a0:1945:efcc:4de5]) by smtp.gmail.com with ESMTPSA id n40sm4185398otb.54.2017.12.02.09.47.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 02 Dec 2017 09:47:34 -0800 (PST) From: Andrew D'Addesio To: ffmpeg-devel@ffmpeg.org Date: Sat, 2 Dec 2017 11:46:57 -0600 Message-Id: <20171202174659.1064-2-modchipv12@gmail.com> X-Mailer: git-send-email 2.15.1.windows.2 In-Reply-To: <20171202174659.1064-1-modchipv12@gmail.com> References: <20171202174659.1064-1-modchipv12@gmail.com> Subject: [FFmpeg-devel] [PATCH 2/4] opus: Fix arithmetic overflows (per RFC8251) X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andrew D'Addesio MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" The relevant sections from the RFC are: Sec.6. Integer Wrap-Around in Inverse Gain Computation 32-bit integer overflow in Levinson recursion. Affects silk_is_lpc_stable(). Sec.8. Cap on Band Energy NaN due to large log-energy value. Affects celt_denormalize(). Signed-off-by: Andrew D'Addesio --- libavcodec/opus_celt.c | 3 ++- libavcodec/opus_silk.c | 11 +++++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/libavcodec/opus_celt.c b/libavcodec/opus_celt.c index 84d4847..ff56041 100644 --- a/libavcodec/opus_celt.c +++ b/libavcodec/opus_celt.c @@ -481,7 +481,8 @@ static void celt_denormalize(CeltFrame *f, CeltBlock *block, float *data) for (i = f->start_band; i < f->end_band; i++) { float *dst = data + (ff_celt_freq_bands[i] << f->size); - float norm = exp2f(block->energy[i] + ff_celt_mean_energy[i]); + float log_norm = block->energy[i] + ff_celt_mean_energy[i]; + float norm = exp2f(FFMIN(log_norm, 32.0f)); for (j = 0; j < ff_celt_freq_range[i] << f->size; j++) dst[j] *= norm; diff --git a/libavcodec/opus_silk.c b/libavcodec/opus_silk.c index 3c9c849..344333c 100644 --- a/libavcodec/opus_silk.c +++ b/libavcodec/opus_silk.c @@ -185,8 +185,15 @@ static inline int silk_is_lpc_stable(const int16_t lpc[16], int order) row = lpc32[k & 1]; for (j = 0; j < k; j++) { - int x = prevrow[j] - ROUND_MULL(prevrow[k - j - 1], rc, 31); - row[j] = ROUND_MULL(x, gain, fbits); + int x = av_sat_sub32(prevrow[j], ROUND_MULL(prevrow[k - j - 1], rc, 31)); + int64_t tmp = ROUND_MULL(x, gain, fbits); + + /* per RFC 8251 section 6, if this calculation overflows, the filter + is considered unstable. */ + if (tmp < INT32_MIN || tmp > INT32_MAX) + return 0; + + row[j] = (int32_t)tmp; } } }