diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-11-03 13:30:50 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-11-04 00:05:46 +0300 |
| commit | cee1f4c06986941bd31cc19f4333d436394aa6f9 (patch) | |
| tree | 19967bb54c2bf4592c4b5185791cafc251380a71 /libavcodec/ac3dec.c | |
| parent | 0bd1be65e88d6a4f367e698d7a2b105424eb1905 (diff) | |
avcodec/ac3dec: Check expacc
this is somewhat a magic number, which can be understood from reading section
"7.1.2 Exponent Strategy" of the ac3 specification, in short:
Three exponents each represented as number 0-4 are grouped together and
base-5 encoded, so the maximal correct value is 25*4 + 5*4 + 4 = 124.
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/ac3dec.c')
| -rw-r--r-- | libavcodec/ac3dec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index a95c2049b5..499971acce 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -426,6 +426,10 @@ static int decode_exponents(AC3DecodeContext *s, group_size = exp_strategy + (exp_strategy == EXP_D45); for (grp = 0, i = 0; grp < ngrps; grp++) { expacc = get_bits(gbc, 7); + if (expacc >= 125) { + av_log(s->avctx, AV_LOG_ERROR, "expacc %d is out-of-range\n", expacc); + return AVERROR_INVALIDDATA; + } dexp[i++] = ungroup_3_in_7_bits_tab[expacc][0]; dexp[i++] = ungroup_3_in_7_bits_tab[expacc][1]; dexp[i++] = ungroup_3_in_7_bits_tab[expacc][2]; |