diff options
| author | Lynne <dev@lynne.ee> | 2024-06-02 23:45:31 +0200 |
|---|---|---|
| committer | Lynne <dev@lynne.ee> | 2024-06-04 03:08:44 +0200 |
| commit | 39826eacff9a93cdea2975bc30057c87e44ffb99 (patch) | |
| tree | 969dbaca435c149f577af78ec05db850ddf3d3e8 | |
| parent | b70fdbde9cef48bc14d7d2095439993c90e2e7d6 (diff) | |
| download | ffmpeg-39826eacff9a93cdea2975bc30057c87e44ffb99.tar.gz | |
aacdec_usac: error out on too many elements
USAC supports up to 64 audio channels, but puts no limit on the total
number of extensions that may be present. Which may mean that there's
a single audio channel, with 65 thousand extension elements.
We assume that 64 elements is the maximum for now. So check the value.
| -rw-r--r-- | libavcodec/aac/aacdec_usac.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c index 19390ad794..99f598b2ad 100644 --- a/libavcodec/aac/aacdec_usac.c +++ b/libavcodec/aac/aacdec_usac.c @@ -393,6 +393,11 @@ int ff_aac_usac_config_decode(AACDecContext *ac, AVCodecContext *avctx, /* UsacDecoderConfig */ elem_id[0] = elem_id[1] = elem_id[2] = 0; usac->nb_elems = get_escaped_value(gb, 4, 8, 16) + 1; + if (usac->nb_elems > 64) { + av_log(ac->avctx, AV_LOG_ERROR, "Too many elements: %i\n", + usac->nb_elems); + return AVERROR(EINVAL); + } for (int i = 0; i < usac->nb_elems; i++) { AACUsacElemConfig *e = &usac->elems[i]; |