diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-07 23:43:03 +0400 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2011-12-24 15:20:33 +0400 |
| commit | 5394cdf7759ca12f0dde2c31483ecb5f3450afda (patch) | |
| tree | c63ba7c7a2b277c99a8f61586ed33d359a465a3e /libavcodec | |
| parent | 7f163e5a8749845b8fb25337a1b7023a8d9d4bc0 (diff) | |
Fixed segfault with wavpack decoder on corrupted decorrelation terms sub-blocks.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8bfea4ab4e2cb32bc7bf6f697ee30a238c65d296)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/wavpack.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index db83c44132..43f28a67d4 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -776,12 +776,13 @@ static int wavpack_decode_frame(AVCodecContext *avctx, } switch(id & WP_IDF_MASK){ case WP_ID_DECTERMS: - s->terms = size; - if(s->terms > MAX_TERMS){ + if(size > MAX_TERMS){ av_log(avctx, AV_LOG_ERROR, "Too many decorrelation terms\n"); + s->terms = 0; buf += ssize; continue; } + s->terms = size; for(i = 0; i < s->terms; i++) { s->decorr[s->terms - i - 1].value = (*buf & 0x1F) - 5; s->decorr[s->terms - i - 1].delta = *buf >> 5; |