diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-07 23:12:32 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-09-08 23:48:42 +0200 |
| commit | 90edd5df3d8c7a98372532363a86ffc217b3fa82 (patch) | |
| tree | 38b55ce09cddb13e9e25d690fe2459dcb305bf68 | |
| parent | e6df35b3be5f722f49390b9950dde78975f33350 (diff) | |
| download | ffmpeg-90edd5df3d8c7a98372532363a86ffc217b3fa82.tar.gz | |
Fixed invalid access in wavpack decoder on corrupted extra bits sub-blocks.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit beefafda639dd53fc59c21d8a7cf8334da9a1062)
| -rw-r--r-- | libavcodec/wavpack.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index d5102320fd..f46f9250de 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -385,7 +385,7 @@ static inline int wv_get_value_integer(WavpackFrameContext *s, uint32_t *crc, in if(s->extra_bits){ S <<= s->extra_bits; - if(s->got_extra_bits){ + if(s->got_extra_bits && get_bits_left(&s->gb_extra_bits) >= s->extra_bits){ S |= get_bits(&s->gb_extra_bits, s->extra_bits); *crc = *crc * 9 + (S&0xffff) * 3 + ((unsigned)S>>16); } |