wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

alac: Check that the channels fit at the given offset

Browse source 
The code tries to decode a number of channels at the
offset given by the ff_alac_channel_layout_offsets table.
Even if the number of channels decoded so far doesn't
exceed the total number of channels, we need to check that
we actually can decode that number of channels at this offset
as well.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 35cbc98b72)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Martin Storsjö 2013-09-03 14:16:40 +03:00 • committed by Luca Barbato
parent 7b9bcd993c
commit 790606cfe9
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
libavcodec/alac.c
View file

@ -418,7 +418,8 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data,
}
channels = (element == TYPE_CPE) ? 2 : 1;
if (ch + channels > alac->channels) {
if (ch + channels > alac->channels ||
ff_alac_channel_layout_offsets[alac->channels - 1][ch] + channels > alac->channels) {
av_log(avctx, AV_LOG_ERROR, "invalid element channel count\n");
return AVERROR_INVALIDDATA;
}