Commit Graph

13 Commits

Author SHA1 Message Date
Michael Niedermayer f8dc85589e avcodec/atrac9dec: Clamp band_ext_data to max that can be read if skipped.
Fixes: out of array read
Fixes: 19327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5679823087468544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 18ff210efb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-01-06 15:03:15 +01:00
Michael Niedermayer 53a03d98bd avcodec/atrac9dec: Check q_unit_cnt more completely before using it to access at9_tab_band_ext_group
Fixes: index 8 out of bounds for type 'const uint8_t [8][3]'
Fixes: 19127/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5709394985091072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e1d836d237)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-01-06 15:03:15 +01:00
Michael Niedermayer 3ba7629104 avcodec/atrac9dec: Check precision_fine/coarse
Clipping is done as it was preferred in review
See: [FFmpeg-devel] [PATCH 1/5] avcodec/atrac9dec: Check precision_fine/coarse

Fixes: out of array access
Fixes: 18330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5641113058148352

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19b8db2908)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-01-06 11:30:44 +01:00
Michael Niedermayer dfb5dc4073 avcodec/atrac9dec: Set channels
Fixes: null pointer dereference
Fixes: 18341/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5681203490848768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e85eb7cb04)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-01-06 11:30:43 +01:00
Michael Niedermayer 14616c63df avcodec/atrac9dec: Check block_align
Fixes: Infinite loop
Fixes: 16260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5676365617037312
Fixes: 16260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5768093879500800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dead949a1f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-01-06 11:30:42 +01:00
Michael Niedermayer c1e67ca966 avcodec/atrac9dec: Check grad_range[1] more tightly
Alternatively the array could be made bigger but the extra values
would not be read without other changes.

Fixes: Out of array access
Fixes: 15658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5738260074070016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 208225bd78)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-01-06 11:30:42 +01:00
Michael Niedermayer 6d3c6e8b96 avcodec/atrac9dec: Check conditions before apply_band_extension() to avoid out of array read in initialization of unused variables
Fixes: global-buffer-overflow
Fixes: 15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c5f265bb24)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-01-06 11:30:42 +01:00
Michael Niedermayer 7daa138f68 avcodec/atrac9dec: Check q_unit_cnt in parse_band_ext()
Fixes: global-buffer-overflow
Fixes: 15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fb4a4557d1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-29 20:30:30 +02:00
Michael Niedermayer 3d1903acfe avcodec/atrac9dec: Check that the reused block has succeeded initilization
Fixes: global-buffer-overflow
Fixes: 15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac9af7e9a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-29 19:36:02 +02:00
Rostislav Pehlivanov 964819fefd atrac9dec: clean up code slightly
Just remove some dead variable assignments, unneeded variables and
change the FFMAX order to something more readable. Still identical.

Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>
2018-08-28 04:25:35 +01:00
Rostislav Pehlivanov ea82ff81e4 atrac9dec: implement LFE channel decoding
Much simpler than regular decoding, does allow for 5.1 and 7.1
streams to be decoded without desync.

Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>
2018-08-27 23:18:03 +01:00
Rostislav Pehlivanov 6213cf7394 atrac9dec: relax gradient value requirements
Unlike the range, the gradient start value does not have to be lower
than the end value.
Does allow more files to be correctly decoded without errors.

Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>
2018-08-27 23:18:03 +01:00
Rostislav Pehlivanov 755e618399 lavc: implement an ATRAC9 decoder
This commit implements a full ATRAC9 decoder, a simple low-delay codec
developed by Sony and used in most PSVita games, some PS3 games and some
PS4 games. Its similar to AAC in that it uses Huffman coded scalefactors
but instead of vector quantization it just Huffman codes the spectral
coefficients (in a way similar to how Opus splits band energy coding
into coarse and fine precision). It opts to write rather large Huffman
codes by packing several small coefficients into one Huffman coded
symbol, though I don't believe this increases efficiency at all.
Band extension implements SBC in a simple way, first it mirrors the
lower spectrum onto the higher frequencies and then it uses one of 5
filters to shape it. Noise substitution is implemented via 2 of them.
Unlike previous ATRAC codecs, there's no QMF, this is a standard MDCT
codec.

Based off of the reverse engineering work of Alex Barney.

Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>
2018-07-03 20:15:01 +01:00