diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2012-12-01 21:42:02 +0100 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2012-12-01 22:10:42 +0100 |
commit | 3b2cd83a829e01a603b52fdc058a054b7899d06e (patch) | |
tree | 617bf8d96bb143c8659602405f712dc18dd6402c /libavcodec/dcadec.c | |
parent | 56e149fda991e6fbf7b920bfcb2e0181fb8463b1 (diff) | |
download | ffmpeg-streaming-3b2cd83a829e01a603b52fdc058a054b7899d06e.zip ffmpeg-streaming-3b2cd83a829e01a603b52fdc058a054b7899d06e.tar.gz |
dcadec: check lfe field
Fix out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/dcadec.c')
-rw-r--r-- | libavcodec/dcadec.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c index 8b985a8..77fe92a 100644 --- a/libavcodec/dcadec.c +++ b/libavcodec/dcadec.c @@ -737,6 +737,12 @@ static int dca_parse_frame_header(DCAContext *s) s->lfe = get_bits(&s->gb, 2); s->predictor_history = get_bits(&s->gb, 1); + if (s->lfe == 3) { + s->lfe = 0; + av_log_ask_for_sample(s->avctx, "LFE is 3\n"); + return AVERROR_PATCHWELCOME; + } + /* TODO: check CRC */ if (s->crc_present) s->header_crc = get_bits(&s->gb, 16); |