diff options
author | Alex Converse <alex.converse@gmail.com> | 2012-06-05 05:27:03 +0400 |
---|---|---|
committer | Alex Converse <alex.converse@gmail.com> | 2012-06-05 20:51:51 +0400 |
commit | ecf79c4d3e8baaf2f303278ef81db6f8407656bc (patch) | |
tree | 5a0f45fbc87f874fc2194128f37361fc23074657 /libavcodec/vorbis.c | |
parent | 503f2feb143b58bf9b7850ef00ec0bb02d509f78 (diff) |
vorbis: Validate that the floor 1 X values contain no duplicates.
Duplicate values in this vector are explicitly banned by the Vorbis I spec
and cause divide-by-zero crashes later on.
Diffstat (limited to 'libavcodec/vorbis.c')
-rw-r--r-- | libavcodec/vorbis.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libavcodec/vorbis.c b/libavcodec/vorbis.c index 52ded8b0a8..16fb998fab 100644 --- a/libavcodec/vorbis.c +++ b/libavcodec/vorbis.c @@ -119,7 +119,8 @@ int ff_vorbis_len2vlc(uint8_t *bits, uint32_t *codes, unsigned num) return 0; } -void ff_vorbis_ready_floor1_list(vorbis_floor1_entry * list, int values) +int ff_vorbis_ready_floor1_list(AVCodecContext *avccontext, + vorbis_floor1_entry *list, int values) { int i; list[0].sort = 0; @@ -143,6 +144,11 @@ void ff_vorbis_ready_floor1_list(vorbis_floor1_entry * list, int values) for (i = 0; i < values - 1; i++) { int j; for (j = i + 1; j < values; j++) { + if (list[i].x == list[j].x) { + av_log(avccontext, AV_LOG_ERROR, + "Duplicate value found in floor 1 X coordinates\n"); + return AVERROR_INVALIDDATA; + } if (list[list[i].sort].x > list[list[j].sort].x) { int tmp = list[i].sort; list[i].sort = list[j].sort; @@ -150,6 +156,7 @@ void ff_vorbis_ready_floor1_list(vorbis_floor1_entry * list, int values) } } } + return 0; } static inline void render_line_unrolled(intptr_t x, int y, int x1, |