diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-10 21:21:50 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-10 21:22:47 +0400 |
| commit | b53f89710b03c4c832bb03e4e132b1ace17fb4e4 (patch) | |
| tree | 3c9907a5621f5d35c9bb67afd20dd797682a8864 /libavcodec/alac.c | |
| parent | 3920d1387834e2bc334aff9f518f4beb24e470bd (diff) | |
alac: Check channel indexes more completely, fix out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/alac.c')
| -rw-r--r-- | libavcodec/alac.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/alac.c b/libavcodec/alac.c index 46c3a5b37b..93db034fec 100644 --- a/libavcodec/alac.c +++ b/libavcodec/alac.c @@ -495,7 +495,9 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data, } channels = (element == TYPE_CPE) ? 2 : 1; - if (ch + channels > alac->channels) { + if ( ch + channels > alac->channels + || alac_channel_layout_offsets[alac->channels - 1][ch] + channels > alac->channels + ) { av_log(avctx, AV_LOG_ERROR, "invalid element channel count\n"); return AVERROR_INVALIDDATA; } |