diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-07-01 02:09:29 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-07-01 02:09:29 +0200 |
| commit | 709cae2bcbc0ea2c5d46c932b3d8301cf8f98e6b (patch) | |
| tree | aef2e4f0b07deed4d94385ccd8f9dfbf4a04e19a | |
| parent | ae038c0914460646503be083e30e3971093239a1 (diff) | |
| download | ffmpeg-709cae2bcbc0ea2c5d46c932b3d8301cf8f98e6b.tar.gz | |
vorbisdec: Check VLC tables during use instead of setup
Fixes regression and Ticket2720
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/vorbisdec.c | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c index 7a7a6dd871..c5950e66a4 100644 --- a/libavcodec/vorbisdec.c +++ b/libavcodec/vorbisdec.c @@ -422,11 +422,6 @@ static int vorbis_parse_setup_hdr_codebooks(vorbis_context *vc) } // Initialize VLC table - if (entries <= 0) { - av_log(vc->avctx, AV_LOG_ERROR, "Invalid codebook entry count\n"); - ret = AVERROR_INVALIDDATA; - goto error; - } if (ff_vorbis_len2vlc(tmp_vlc_bits, tmp_vlc_codes, entries)) { av_log(vc->avctx, AV_LOG_ERROR, " Invalid code lengths while generating vlcs. \n"); ret = AVERROR_INVALIDDATA; @@ -1235,8 +1230,11 @@ static int vorbis_floor1_decode(vorbis_context *vc, cval = cval >> cbits; if (book > -1) { - floor1_Y[offset+j] = get_vlc2(gb, vc->codebooks[book].vlc.table, - vc->codebooks[book].nb_bits, 3); + int v = get_vlc2(gb, vc->codebooks[book].vlc.table, + vc->codebooks[book].nb_bits, 3); + if (v < 0) + return AVERROR_INVALIDDATA; + floor1_Y[offset+j] = v; } else { floor1_Y[offset+j] = 0; } @@ -1330,6 +1328,9 @@ static av_always_inline int setup_classifs(vorbis_context *vc, av_dlog(NULL, "Classword: %u\n", temp); + if ((int)temp < 0) + return temp; + av_assert0(vr->classifications > 1); //needed for inverse[] if (temp <= 65536) { |