diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-20 03:19:39 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-21 05:00:40 +0400 |
| commit | dfeef3a209ecb3dcf01a1ad14e7fc4586e630e93 (patch) | |
| tree | 91a23f8d1841b009b40eb6e65d08e3361c146bd7 | |
| parent | 2b6f3be08250683407c7a9846d7133b116661eae (diff) | |
cook: check js_subband_start for validityn0.8.14
Fixes out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c69315a5deb0f8095e6b4746b69171d6f3059b2f)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/cook.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/cook.c b/libavcodec/cook.c index a5da74efcc..14614c9316 100644 --- a/libavcodec/cook.c +++ b/libavcodec/cook.c @@ -1086,6 +1086,11 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) if (extradata_size >= 8){ bytestream_get_be32(&edata_ptr); //Unknown unused q->subpacket[s].js_subband_start = bytestream_get_be16(&edata_ptr); + if (q->subpacket[s].js_subband_start >= 51) { + av_log(avctx, AV_LOG_ERROR, "js_subband_start %d is too large\n", q->subpacket[s].js_subband_start); + return AVERROR_INVALIDDATA; + } + q->subpacket[s].js_vlc_bits = bytestream_get_be16(&edata_ptr); extradata_size -= 8; } |