[FFmpeg-cvslog] r11883 - trunk/libavcodec/vorbis.c

[Loren Merritt]

On Sun, 10 Feb 2008, Balatoni Denes wrote:
>
> I think x1>samples is allowed by the spec. While it's true that the
> render_line doesn't get samples as an argument, but on the other hand there
> is the last step in curve synthesis, which is:
> 13) if ( [hx] is greater than [n] ) {
> 14) truncate vector [floor] to [n] elements
>     }
>
> Also, the exact same bug (not checking n<samples) was noticed by Oded (see the
> mail on 2006. 09. 23. 16.44 by Oded "[Ffmpeg-devel] Bugs in Vorbis decoder",
> and it's answers), and acknowledged as a bug by me.

Now I can't see how the check (as written) can ever matter. The value of
samples passed into render_list is vf->list[1].x, i.e. the coordinate of
the last point on the curve. This has been the case ever since the vorbis
decoder was first written in r4261 (2005-05-17).
The value that x should be checked against is [n] aka blocksize. Except
that a branch in an inner loop isn't the right fix, instead just allocate
a big enough buffer for floor1 that it fits.

So my commit would have been a regression if Oded's bug was ever fixed.
But it wasn't fixed, so my commit didn't change any behaviour.

--Loren Merritt