diff options
| author | Reinhard Tartler <siretart@tauware.de> | 2013-05-07 07:13:50 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-05-07 07:13:50 +0200 |
| commit | a590979988b135db7c7260f6db2082e19a46609b (patch) | |
| tree | 06ce1f1b6881ce6c4fa468570afcde60c7d15e00 | |
| parent | 7bf6a86f2e49165c60408acde601f6801dc93cb9 (diff) | |
| download | ffmpeg-a590979988b135db7c7260f6db2082e19a46609b.tar.gz | |
aac: check the maximum number of channels
Broken bitstreams could report a larger than specified number of
channels and cause outbound writes.
CC:libav-stable@libav.org
(cherry picked from commit a943a132f36f4df8fe2f749744677b71984abce7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/aacdec.c
| -rw-r--r-- | libavcodec/aacdec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index 6478c7765b..24e6ca6a87 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -192,6 +192,8 @@ static av_cold int che_configure(AACContext *ac, enum ChannelPosition che_pos[4][MAX_ELEM_ID], int type, int id, int *channels) { + if (*channels >= MAX_CHANNELS) + return AVERROR_INVALIDDATA; if (che_pos[type][id]) { if (!ac->che[type][id]) { if (!(ac->che[type][id] = av_mallocz(sizeof(ChannelElement)))) |