diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-11-25 23:16:17 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-08 00:23:23 +0100 |
| commit | c094aec76e291dccf46239a2e221f16d695452d1 (patch) | |
| tree | f2ce51dd93e8334ab80be76ba6cb80b5f6a521be | |
| parent | 5e21989de4c8b4892d6c0c0d897515862533ce7e (diff) | |
| download | ffmpeg-c094aec76e291dccf46239a2e221f16d695452d1.tar.gz | |
avcodec/ac3dec: check bap before use.
Fixes out of array read
Fixes assertion failure
Fixes asan_static-oob_16431c0_8036_rio_bravo_mono_64_spx.ac3
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4782c4284fa3856a9b6910fe5ff6e4fb1c65b58c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/ac3dec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index f91ded0fcb..2acd20949c 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -488,6 +488,10 @@ static void ac3_decode_transform_coeffs_ch(AC3DecodeContext *s, int ch_index, ma break; default: /* 6 to 15 */ /* Shift mantissa and sign-extend it. */ + if (bap > 15) { + av_log(s->avctx, AV_LOG_ERROR, "bap %d is invalid in plain AC-3\n", bap); + bap = 15; + } mantissa = get_sbits(gbc, quantization_tab[bap]); mantissa <<= 24 - quantization_tab[bap]; break; |