diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-13 17:33:03 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-13 17:33:38 +0100 |
| commit | a0212ecf8452e9861286639543a772dc94f3ad07 (patch) | |
| tree | c9d384eaa37ab65d4ade5d2e45b341c34cbed6cf | |
| parent | 4facddd568b7b6c0014b4a0da157b8ba8f3e3b1a (diff) | |
| download | ffmpeg-a0212ecf8452e9861286639543a772dc94f3ad07.tar.gz | |
dcadec: check layout & channel count for consistency.
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/dcadec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c index c21a97b2ec..dabc5a4ee1 100644 --- a/libavcodec/dcadec.c +++ b/libavcodec/dcadec.c @@ -2249,6 +2249,11 @@ static int dca_decode_frame(AVCodecContext *avctx, void *data, s->channel_order_tab[channels - 1 - !!s->lfe] < 0) return AVERROR_INVALIDDATA; + if (av_get_channel_layout_nb_channels(avctx->channel_layout) != channels) { + av_log(avctx, AV_LOG_ERROR, "Number of channels %d mismatches layout %d\n", channels, av_get_channel_layout_nb_channels(avctx->channel_layout)); + return AVERROR_INVALIDDATA; + } + if (avctx->request_channels == 2 && s->prim_channels > 2) { channels = 2; s->output = DCA_STEREO; |