diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-14 20:49:25 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-01 23:25:21 +0200 |
| commit | c55a6bac6c3c976a2861faaa96634cdf2176f44c (patch) | |
| tree | 1c18f46d845d7e2d91ca310d94a7d13f14e7c0b4 | |
| parent | fea9ed39e670736c492deac42785a451e0d6282e (diff) | |
| download | ffmpeg-c55a6bac6c3c976a2861faaa96634cdf2176f44c.tar.gz | |
avcodec/dcadec: Check nchans
Fixes CID1239110
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a6a45774d045007f8262cd7c614804390e53122e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/dcadec.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c index 7d798b00fb..7cdf4b4beb 100644 --- a/libavcodec/dcadec.c +++ b/libavcodec/dcadec.c @@ -583,6 +583,14 @@ static int dca_parse_audio_coding_header(DCAContext *s, int base_channel, } nchans = get_bits(&s->gb, 3) + 1; + if (xxch && nchans >= 3) { + av_log(s->avctx, AV_LOG_ERROR, "nchans %d is too large\n", nchans); + return AVERROR_INVALIDDATA; + } else if (nchans + base_channel > DCA_PRIM_CHANNELS_MAX) { + av_log(s->avctx, AV_LOG_ERROR, "channel sum %d + %d is too large\n", nchans, base_channel); + return AVERROR_INVALIDDATA; + } + s->total_channels = nchans + base_channel; s->prim_channels = s->total_channels; |