From patchwork Tue Sep 8 21:18:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Rheinhardt X-Patchwork-Id: 22176 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id E894744BD83 for ; Wed, 9 Sep 2020 00:19:26 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id D10CC68B6A3; Wed, 9 Sep 2020 00:19:26 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 86A5068B698 for ; Wed, 9 Sep 2020 00:19:25 +0300 (EEST) Received: by mail-wm1-f43.google.com with SMTP id l9so365917wme.3 for ; Tue, 08 Sep 2020 14:19:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=RE1P2xBdlY4ivyEzi5RXEHTkW2dZokWyhgXi4rfYCf0=; b=rWCIZn5bhF6MEdsyU76EuxazHHrOoOJOM0w1UZ7ArqT68ho3m2pgaOwIr7Q3MlT0vV 01aJo2vbcJkNqEk147WBlX+CK6a8Kqk4yx/H3MzBYBw/zoUdymB3HXxrpJ/ZbzfEiTd3 prML1SiwJGJ8niC/mVRHIG4VP+w2ado0y2ogssXshl2jEK+nZdhVbmLdauET+kssQ12b +Box8PxP9wzM0M7WpG5va25+I/fvQarMcPn17c+8aAwWlurb+EinJdy2AZHqn6jx3h31 3e3CxwJet78l/QwA3YELEy5M4qSaRiUC6ybvRwFWJn20F/8yN6scg16EdXEBdymyZp/f 1Qeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=RE1P2xBdlY4ivyEzi5RXEHTkW2dZokWyhgXi4rfYCf0=; b=JgC7xWrHuPbP2Jce+CF/2+LreYeoGcBndKhrjbYje2v0/k2T+Kjdtk6ME1THt2aR2k hXLzSCqdts06rN7tc4MvtJXsdt6yauH4pYIyw9g1/9o0Ot6KISWuu3P2+/waOI69PMTZ jT5EZbru5wVPwxz+L1/eEp1hSSs3kBvmKurgOlupSRbU+sPcF97vaRILsSsmRJxh14cJ QB64SBkLtkbbshG8VqODiJo3v9gye1vo6REC3FL6oKN8fT0zfYhLS5bdZL7RGaoIn4FM Zkd8NM3dhUeR3YGoTtlKdtZHvJJkCTlqbIMgiC9xSiM42PsZoBm1xpiKk6M8dzcjfL2Z UXUQ== X-Gm-Message-State: AOAM533WkN1wd7OzmCV1O6x+yT8Xhp6pGogSAKM+MxrvfVf2qTG08NOl DCvVDeaUEsC1RrHTCxK0L9BQ3pqYCLo= X-Google-Smtp-Source: ABdhPJwNVefUP/DhD9CsB/cvr/cJmVrWsFDeSIogM8QOq9tIP/OAy9KFF19yVozSeQu7aNv0os2vSw== X-Received: by 2002:a1c:c906:: with SMTP id f6mr342411wmb.9.1599599964550; Tue, 08 Sep 2020 14:19:24 -0700 (PDT) Received: from sblaptop.fritz.box (ipbcc1fb0f.dynamic.kabel-deutschland.de. [188.193.251.15]) by smtp.gmail.com with ESMTPSA id a15sm1074304wrn.3.2020.09.08.14.19.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Sep 2020 14:19:23 -0700 (PDT) From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Tue, 8 Sep 2020 23:18:36 +0200 Message-Id: <20200908211856.16290-5-andreas.rheinhardt@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200908211856.16290-1-andreas.rheinhardt@gmail.com> References: <20200908211856.16290-1-andreas.rheinhardt@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 05/25] avfilter/af_headphone: Don't overrun array X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" The headphone filter stores the channel position of the ith HRIR stream in the ith element of an array of 64 elements; but because there is no check for duplicate channels, it is easy to write beyond the end of the array by simply repeating channels. This commit adds a check for duplicate channels to rule this out. Signed-off-by: Andreas Rheinhardt --- libavfilter/af_headphone.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/libavfilter/af_headphone.c b/libavfilter/af_headphone.c index 54b5dfec4c..99bdefbcff 100644 --- a/libavfilter/af_headphone.c +++ b/libavfilter/af_headphone.c @@ -88,15 +88,13 @@ typedef struct HeadphoneContext { } *in; } HeadphoneContext; -static int parse_channel_name(HeadphoneContext *s, int x, char **arg, int *rchannel, char *buf) +static int parse_channel_name(char **arg, int *rchannel, char *buf) { int len, i, channel_id = 0; int64_t layout, layout0; if (sscanf(*arg, "%7[A-Z]%n", buf, &len)) { layout0 = layout = av_get_channel_layout(buf); - if (layout == AV_CH_LOW_FREQUENCY) - s->lfe_channel = x; for (i = 32; i > 0; i >>= 1) { if (layout >= 1LL << i) { channel_id += i; @@ -116,6 +114,7 @@ static void parse_map(AVFilterContext *ctx) { HeadphoneContext *s = ctx->priv; char *arg, *tokenizer, *p, *args = av_strdup(s->map); + uint64_t used_channels = 0; int i; if (!args) @@ -134,10 +133,17 @@ static void parse_map(AVFilterContext *ctx) char buf[8]; p = NULL; - if (parse_channel_name(s, s->nb_irs, &arg, &out_ch_id, buf)) { + if (parse_channel_name(&arg, &out_ch_id, buf)) { av_log(ctx, AV_LOG_WARNING, "Failed to parse \'%s\' as channel name.\n", arg); continue; } + if (used_channels & (1ULL << out_ch_id)) { + av_log(ctx, AV_LOG_WARNING, "Ignoring duplicate channel '%s'.\n", buf); + continue; + } + used_channels |= 1ULL << out_ch_id; + if (out_ch_id == av_log2(AV_CH_LOW_FREQUENCY)) + s->lfe_channel = s->nb_irs; s->mapping[s->nb_irs] = out_ch_id; s->nb_irs++; }