From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id E94DF4C2A8 for ; Wed, 10 Dec 2025 00:39:57 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (body hash mismatch (got b'dlBBLQdf+tuZNcoz43s3wBU/XUgz7BN/H2JNlx1cQrU=', expected b'9TXd7wKdaUawOoj/rlzHfOOiyyBMz7x7Dx78JTRFBF4=')) header.d=ffmpeg.org header.i=@ffmpeg.org header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1765327177; h=mime-version : to : date : message-id : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-type : content-transfer-encoding : from; bh=dlBBLQdf+tuZNcoz43s3wBU/XUgz7BN/H2JNlx1cQrU=; b=SXoGW9N2ng+fUktYIP6mCntm5zEDaWJBFzxvzuiwSqrlzN4BXixe4dTnb+bUsQbbTWyAA Kjb0sPtIT7gyAdMKzNPoaFUC6id41sYytjk3yDzL4UrN4fOcT9VnsEetCxLo5d4bUf2Lcs4 YobVQjQlaD1j8LZpr0/MNvFoEIlwwVETAXsVxWDRduEOwi7xDhlbYrhTgh2A+7uhZV8Iz1m o8F9nNAUNzPV0CeopWT2berquXCAfZgNY2ql/3xbYO8v7jwt78PN0D/lQGySqcu8QbaEy+Z p3YC0dpxnrTfwePdnEphW+9YHmiE8CD5K2yxzOBZm2Hzxp6IMSLT07aXqkmw== Received: from [172.19.0.3] (unknown [172.19.0.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 3A1CD690725; Wed, 10 Dec 2025 02:39:37 +0200 (EET) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1765327161; b=PLCQvIB/ttxiohuVmj7ar0k9Lt3g9fYgqCycWbqOje3Xpj1zjtGbIcoy/AM1wJI68VmSo u1Os2hdspOphAJNutXrHQs6P/qR0raJ2NklGvNld655KpLjpPoGcSF0z9fUd9UmL9xqg96X f06mMygb1x/wF4tbOvDgSBSAWEsGV9MI1qOzCEZzjUB3B/b5nNOvvlw5UWszV1G+ywfNKlE Pb4vXlO9FTEbHXuPEJuKe/5b/qV8uISwOQjqMPgE4bLQg4CO0IXjSGPKUjfNaTkfLEfGbrF UKs66NXLqNTu238H9NgWV89SkwYAkLefjlHLvEwmkTlF9PJL1TtsBaYhETpw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1765327161; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=hjMB5EYJTKyp0NMazVSfEMnLlDBwld17FTIYgiC7NcA=; b=nuUCZ1SAdQ/sRR4MWvgZl/NVpnTTDbnxRMwpzHONACuOIdWl9CwTheOr6GUjIvLzklLfO 1NqcfIpk9H9qHrns51Ee6K/MFKke8Bx23Rs8EYjcnZjHPqkFYNqAc0S78VqdzNrCGsGL67/ hmCCo5c2PveWMUs0klJ9oXy/8VNbvWWmYKXhjS527EknqswcWDNphTG3UGGPfrQeOabjfaE WI+HoJdHe/h/VcGgf1FzjoiZJLH7y4Cr63CpCKpZP0d6iDc/ut2p1WIPVkBNA0NR23/a5SW A98lfZpkFIoTXMCzK0wpelS5VEpng7uUTz6vFpuD4aU6eTnSiZEvonICm58Q== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none; dmarc=pass header.from=ffmpeg.org policy.dmarc=quarantine Authentication-Results: ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=ffmpeg.org policy.dmarc=quarantine DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1765327153; h=content-type : mime-version : content-transfer-encoding : from : to : reply-to : subject : date : from; bh=9TXd7wKdaUawOoj/rlzHfOOiyyBMz7x7Dx78JTRFBF4=; b=ik0rcczayZYawpHdjd0e337LWWvUZD8x1aNF1s67OFmtWyq56sq0nZFSP6N1Jt8yWTJDU s/ykiQDlkW+lYDO/HRxJRr5qiesmQa4LnXh5S6621hiRMzgCp0uTPN/XkiZLA23m0/25B4P 5sXniFi823PHJx6YC4hegJkYod2DL4F3CN1QbIbxbDIeyVaU4K9vIMY//SuMnV7hUGrVzNI qnuFxpF40D5vUtcyMqerqk/BW5vnaUEoLU/3XMGjZck+T3RZUnxUsxXizBio/LmZ3YCWO4L lDfstoXjFFE7h+mYitLxYi8cofbVP5hy/ofBIZkXOanZDfiBrRAEyMQj77aw== Received: from 55ca25703178 (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 2F439690602 for ; Wed, 10 Dec 2025 02:39:13 +0200 (EET) MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Date: Wed, 10 Dec 2025 00:39:12 -0000 Message-ID: <176532715341.39.13689861116295499662@2cb04c0e5124> Message-ID-Hash: LRQTLTHS6QYIWA2TVTHICY3G4XURIH6H X-Message-ID-Hash: LRQTLTHS6QYIWA2TVTHICY3G4XURIH6H X-MailFrom: code@ffmpeg.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PATCH] wmadec: minor cleanups (PR #21150) List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Marvin Scholz via ffmpeg-devel Cc: Marvin Scholz Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Archived-At: List-Archive: List-Post: PR #21150 opened by Marvin Scholz (ePirat) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21150 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21150.patch Adds an assert for the channel count and narrow scope of loop variables. >>From 8d22dbb0fa4f06039ca1d31ac6859a2fe0ea9065 Mon Sep 17 00:00:00 2001 From: Marvin Scholz Date: Wed, 10 Dec 2025 01:06:26 +0100 Subject: [PATCH 1/2] lavc: wmadec: assert channels count This should never exceed MAX_CHANNELS, else there will be several out of bounds writes. --- libavcodec/wmadec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/wmadec.c b/libavcodec/wmadec.c index 78ea25e109..dbc0489ca3 100644 --- a/libavcodec/wmadec.c +++ b/libavcodec/wmadec.c @@ -36,6 +36,7 @@ #include "config_components.h" #include "libavutil/attributes.h" +#include "libavutil/avassert.h" #include "libavutil/ffmath.h" #include "avcodec.h" @@ -454,6 +455,8 @@ static int wma_decode_block(WMACodecContext *s) AVTXContext *mdct; av_tx_fn mdct_fn; + av_assert2(channels <= MAX_CHANNELS); + #ifdef TRACE ff_tlog(s->avctx, "***decode_block: %d:%d\n", s->frame_count - 1, s->block_num); -- 2.49.1 >>From ea2206f527f33753ab527d36fb9c87dc769be696 Mon Sep 17 00:00:00 2001 From: Marvin Scholz Date: Wed, 10 Dec 2025 01:36:27 +0100 Subject: [PATCH 2/2] lavc: wmadec: limit variable scopes Moves the loop variable declarations to the actual loops, narrowing their scopes. --- libavcodec/wmadec.c | 66 ++++++++++++++++++++++----------------------- 1 file changed, 32 insertions(+), 34 deletions(-) diff --git a/libavcodec/wmadec.c b/libavcodec/wmadec.c index dbc0489ca3..433e4b94bb 100644 --- a/libavcodec/wmadec.c +++ b/libavcodec/wmadec.c @@ -448,7 +448,7 @@ static void wma_window(WMACodecContext *s, float *out) static int wma_decode_block(WMACodecContext *s) { int channels = s->avctx->ch_layout.nb_channels; - int n, v, a, ch, bsize; + int n, v, a, bsize; int coef_nb_bits, total_gain; int nb_coefs[MAX_CHANNELS]; float mdct_norm; @@ -519,7 +519,7 @@ static int wma_decode_block(WMACodecContext *s) if (channels == 2) s->ms_stereo = get_bits1(&s->gb); v = 0; - for (ch = 0; ch < channels; ch++) { + for (int ch = 0; ch < channels; ch++) { a = get_bits1(&s->gb); s->channel_coded[ch] = a; v |= a; @@ -550,17 +550,17 @@ static int wma_decode_block(WMACodecContext *s) /* compute number of coefficients */ n = s->coefs_end[bsize] - s->coefs_start; - for (ch = 0; ch < channels; ch++) + for (int ch = 0; ch < channels; ch++) nb_coefs[ch] = n; /* complex coding */ if (s->use_noise_coding) { - for (ch = 0; ch < channels; ch++) { + for (int ch = 0; ch < channels; ch++) { if (s->channel_coded[ch]) { - int i, n, a; + int n; n = s->exponent_high_sizes[bsize]; - for (i = 0; i < n; i++) { - a = get_bits1(&s->gb); + for (int i = 0; i < n; i++) { + const unsigned a = get_bits1(&s->gb); s->high_band_coded[ch][i] = a; /* if noise coding, the coefficients are not transmitted */ if (a) @@ -568,13 +568,13 @@ static int wma_decode_block(WMACodecContext *s) } } } - for (ch = 0; ch < channels; ch++) { + for (int ch = 0; ch < channels; ch++) { if (s->channel_coded[ch]) { - int i, n, val; + int n, val; n = s->exponent_high_sizes[bsize]; val = (int) 0x80000000; - for (i = 0; i < n; i++) { + for (int i = 0; i < n; i++) { if (s->high_band_coded[ch][i]) { if (val == (int) 0x80000000) { val = get_bits(&s->gb, 7) - 19; @@ -591,7 +591,7 @@ static int wma_decode_block(WMACodecContext *s) /* exponents can be reused in short blocks. */ if ((s->block_len_bits == s->frame_len_bits) || get_bits1(&s->gb)) { - for (ch = 0; ch < channels; ch++) { + for (int ch = 0; ch < channels; ch++) { if (s->channel_coded[ch]) { if (s->use_exp_vlc) { if (decode_exp_vlc(s, ch) < 0) @@ -605,13 +605,13 @@ static int wma_decode_block(WMACodecContext *s) } } - for (ch = 0; ch < channels; ch++) { + for (int ch = 0; ch < channels; ch++) { if (s->channel_coded[ch] && !s->exponents_initialized[ch]) return AVERROR_INVALIDDATA; } /* parse spectral coefficients : just RLE encoding */ - for (ch = 0; ch < channels; ch++) { + for (int ch = 0; ch < channels; ch++) { if (s->channel_coded[ch]) { int tindex; WMACoef *ptr = &s->coefs1[ch][0]; @@ -641,11 +641,11 @@ static int wma_decode_block(WMACodecContext *s) } /* finally compute the MDCT coefficients */ - for (ch = 0; ch < channels; ch++) { + for (int ch = 0; ch < channels; ch++) { if (s->channel_coded[ch]) { WMACoef *coefs1; float *coefs, *exponents, mult, mult1, noise; - int i, j, n, n1, last_high_band, esize; + int n, n1, last_high_band, esize; float exp_power[HIGH_BAND_MAX_SIZE]; coefs1 = s->coefs1[ch]; @@ -657,7 +657,7 @@ static int wma_decode_block(WMACodecContext *s) if (s->use_noise_coding) { mult1 = mult; /* very low freqs : noise */ - for (i = 0; i < s->coefs_start; i++) { + for (int i = 0; i < s->coefs_start; i++) { *coefs++ = s->noise_table[s->noise_index] * exponents[i << bsize >> esize] * mult1; s->noise_index = (s->noise_index + 1) & @@ -670,13 +670,13 @@ static int wma_decode_block(WMACodecContext *s) exponents = s->exponents[ch] + (s->high_band_start[bsize] << bsize >> esize); last_high_band = 0; /* avoid warning */ - for (j = 0; j < n1; j++) { + for (int j = 0; j < n1; j++) { n = s->exponent_high_bands[s->frame_len_bits - s->block_len_bits][j]; if (s->high_band_coded[ch][j]) { float e2, v; e2 = 0; - for (i = 0; i < n; i++) { + for (int i = 0; i < n; i++) { v = exponents[i << bsize >> esize]; e2 += v * v; } @@ -689,7 +689,7 @@ static int wma_decode_block(WMACodecContext *s) /* main freqs and high freqs */ exponents = s->exponents[ch] + (s->coefs_start << bsize >> esize); - for (j = -1; j < n1; j++) { + for (int j = -1; j < n1; j++) { if (j < 0) n = s->high_band_start[bsize] - s->coefs_start; else @@ -702,7 +702,7 @@ static int wma_decode_block(WMACodecContext *s) mult1 = mult1 * ff_exp10(s->high_band_values[ch][j] * 0.05); mult1 = mult1 / (s->max_exponent[ch] * s->noise_mult); mult1 *= mdct_norm; - for (i = 0; i < n; i++) { + for (int i = 0; i < n; i++) { noise = s->noise_table[s->noise_index]; s->noise_index = (s->noise_index + 1) & (NOISE_TAB_SIZE - 1); *coefs++ = noise * exponents[i << bsize >> esize] * mult1; @@ -710,7 +710,7 @@ static int wma_decode_block(WMACodecContext *s) exponents += n << bsize >> esize; } else { /* coded values + small noise */ - for (i = 0; i < n; i++) { + for (int i = 0; i < n; i++) { noise = s->noise_table[s->noise_index]; s->noise_index = (s->noise_index + 1) & (NOISE_TAB_SIZE - 1); *coefs++ = ((*coefs1++) + noise) * @@ -723,26 +723,26 @@ static int wma_decode_block(WMACodecContext *s) /* very high freqs : noise */ n = s->block_len - s->coefs_end[bsize]; mult1 = mult * exponents[(-(1 << bsize)) >> esize]; - for (i = 0; i < n; i++) { + for (int i = 0; i < n; i++) { *coefs++ = s->noise_table[s->noise_index] * mult1; s->noise_index = (s->noise_index + 1) & (NOISE_TAB_SIZE - 1); } } else { /* XXX: optimize more */ - for (i = 0; i < s->coefs_start; i++) + for (int i = 0; i < s->coefs_start; i++) *coefs++ = 0.0; n = nb_coefs[ch]; - for (i = 0; i < n; i++) + for (int i = 0; i < n; i++) *coefs++ = coefs1[i] * exponents[i << bsize >> esize] * mult; n = s->block_len - s->coefs_end[bsize]; - for (i = 0; i < n; i++) + for (int i = 0; i < n; i++) *coefs++ = 0.0; } } } #ifdef TRACE - for (ch = 0; ch < channels; ch++) { + for (int ch = 0; ch < channels; ch++) { if (s->channel_coded[ch]) { dump_floats(s, "exponents", 3, s->exponents[ch], s->block_len); dump_floats(s, "coefs", 1, s->coefs[ch], s->block_len); @@ -767,7 +767,7 @@ next: mdct = s->mdct_ctx[bsize]; mdct_fn = s->mdct_fn[bsize]; - for (ch = 0; ch < channels; ch++) { + for (int ch = 0; ch < channels; ch++) { int n4, index; n4 = s->block_len / 2; @@ -794,8 +794,6 @@ next: static int wma_decode_frame(WMACodecContext *s, float **samples, int samples_offset) { - int ret, ch; - #ifdef TRACE ff_tlog(s->avctx, "***decode_frame: %d size=%d\n", s->frame_count++, s->frame_len); @@ -805,14 +803,14 @@ static int wma_decode_frame(WMACodecContext *s, float **samples, s->block_num = 0; s->block_pos = 0; for (;;) { - ret = wma_decode_block(s); + int ret = wma_decode_block(s); if (ret < 0) return ret; if (ret) break; } - for (ch = 0; ch < s->avctx->ch_layout.nb_channels; ch++) { + for (int ch = 0; ch < s->avctx->ch_layout.nb_channels; ch++) { /* copy current block to output */ memcpy(samples[ch] + samples_offset, s->frame_out[ch], s->frame_len * sizeof(*s->frame_out[ch])); @@ -835,7 +833,7 @@ static int wma_decode_superframe(AVCodecContext *avctx, AVFrame *frame, const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; WMACodecContext *s = avctx->priv_data; - int nb_frames, bit_offset, i, pos, len, ret; + int nb_frames, bit_offset, pos, len, ret; uint8_t *q; float **samples; int samples_offset; @@ -851,7 +849,7 @@ static int wma_decode_superframe(AVCodecContext *avctx, AVFrame *frame, return ret; frame->pts = AV_NOPTS_VALUE; - for (i = 0; i < s->avctx->ch_layout.nb_channels; i++) + for (int i = 0; i < s->avctx->ch_layout.nb_channels; i++) memcpy(frame->extended_data[i], &s->frame_out[i][0], frame->nb_samples * sizeof(s->frame_out[i][0])); @@ -963,7 +961,7 @@ static int wma_decode_superframe(AVCodecContext *avctx, AVFrame *frame, skip_bits(&s->gb, len); s->reset_block_lengths = 1; - for (i = 0; i < nb_frames; i++) { + for (int i = 0; i < nb_frames; i++) { if ((ret = wma_decode_frame(s, samples, samples_offset)) < 0) goto fail; samples_offset += s->frame_len; -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org