diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-14 20:49:25 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-21 20:43:39 +0200 |
| commit | 474bfd54388566f752b09eb9df8a038f04d238ba (patch) | |
| tree | ce45a42e473fdc56b3fb8719538150f95e45fe38 | |
| parent | 02c1074f18f6d696122e1fc098bff8e9b6adcae8 (diff) | |
| download | ffmpeg-474bfd54388566f752b09eb9df8a038f04d238ba.tar.gz | |
avcodec/dcadec: Check nchans
Fixes CID1239110
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a6a45774d045007f8262cd7c614804390e53122e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/dcadec.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c index 40d8e9e2f0..3e994daa10 100644 --- a/libavcodec/dcadec.c +++ b/libavcodec/dcadec.c @@ -584,6 +584,14 @@ static int dca_parse_audio_coding_header(DCAContext *s, int base_channel, } nchans = get_bits(&s->gb, 3) + 1; + if (xxch && nchans >= 3) { + av_log(s->avctx, AV_LOG_ERROR, "nchans %d is too large\n", nchans); + return AVERROR_INVALIDDATA; + } else if (nchans + base_channel > DCA_PRIM_CHANNELS_MAX) { + av_log(s->avctx, AV_LOG_ERROR, "channel sum %d + %d is too large\n", nchans, base_channel); + return AVERROR_INVALIDDATA; + } + s->total_channels = nchans + base_channel; s->prim_channels = s->total_channels; |