Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/FFmpeg/FFmpeg.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2021-05-28 21:31:19 +0300
committerMichael Niedermayer <michael@niedermayer.cc>2021-10-06 14:54:16 +0300
commit196d21d7eea22b9bd9c7f6b1ef20c6198dc4841a (patch)
tree976055f9da997d79c43df14d15305415d23d8c12
parente56ee5a3e4d5110d2ef718249613591ad9c6a8e0 (diff)
avcodec/lpc: Avoid floating point division by 0
Fixes: Ticket7996 Fixes: CVE-2020-20445 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 38d18fb57863bb9c54e68ae44aa780c5c282a184) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/lpc.c2
-rw-r--r--libavcodec/lpc.h4
2 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/lpc.c b/libavcodec/lpc.c
index f8da1e1266..c990cfc6c3 100644
--- a/libavcodec/lpc.c
+++ b/libavcodec/lpc.c
@@ -188,7 +188,7 @@ double ff_lpc_calc_ref_coefs_f(LPCContext *s, const float *samples, int len,
compute_ref_coefs(autoc, order, ref, error);
for (i = 0; i < order; i++)
avg_err = (avg_err + error[i])/2.0f;
- return signal/avg_err;
+ return avg_err ? signal/avg_err : NAN;
}
/**
diff --git a/libavcodec/lpc.h b/libavcodec/lpc.h
index 88ca247f87..52170fd623 100644
--- a/libavcodec/lpc.h
+++ b/libavcodec/lpc.h
@@ -143,7 +143,7 @@ static inline void compute_ref_coefs(const LPC_TYPE *autoc, int max_order,
gen0[i] = gen1[i] = autoc[i + 1];
err = autoc[0];
- ref[0] = -gen1[0] / err;
+ ref[0] = -gen1[0] / ((USE_FIXED || err) ? err : 1);
err += gen1[0] * ref[0];
if (error)
error[0] = err;
@@ -152,7 +152,7 @@ static inline void compute_ref_coefs(const LPC_TYPE *autoc, int max_order,
gen1[j] = gen1[j + 1] + ref[i - 1] * gen0[j];
gen0[j] = gen1[j + 1] * ref[i - 1] + gen0[j];
}
- ref[i] = -gen1[0] / err;
+ ref[i] = -gen1[0] / ((USE_FIXED || err) ? err : 1);
err += gen1[0] * ref[i];
if (error)
error[i] = err;