diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-09-30 01:03:58 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-09-30 01:17:45 +0400 |
| commit | 9e58d46edf95e5da585e613b22e1255cf279b5cf (patch) | |
| tree | 0b2e9f3cf579b726f845db066f4a4ebdd207dd8a /libavcodec/alac.c | |
| parent | 17049bff64f27e67e9742193a8e033abf8d1d009 (diff) | |
| parent | 59480abce7e4238e22b3a4a904a9fe6abf4e4188 (diff) | |
Merge commit '59480abce7e4238e22b3a4a904a9fe6abf4e4188'
* commit '59480abce7e4238e22b3a4a904a9fe6abf4e4188':
alac: Do bounds checking of lpc_order read from the bitstream
See: fd4f4923cce6a2cbf4f48640b4ac706e614a1594
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/alac.c')
| -rw-r--r-- | libavcodec/alac.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/alac.c b/libavcodec/alac.c index 69384dc432..cf19484fe6 100644 --- a/libavcodec/alac.c +++ b/libavcodec/alac.c @@ -320,6 +320,9 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index, rice_history_mult[ch] = get_bits(&alac->gb, 3); lpc_order[ch] = get_bits(&alac->gb, 5); + if (lpc_order[ch] >= alac->max_samples_per_frame) + return AVERROR_INVALIDDATA; + /* read the predictor table */ for (i = lpc_order[ch] - 1; i >= 0; i--) lpc_coefs[ch][i] = get_sbits(&alac->gb, 16); |