diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-07-29 02:54:53 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-07-29 03:16:38 +0200 |
| commit | 7118358a950e20a4439d796f16892b27dad6c754 (patch) | |
| tree | 356da393ce8365c6cd9f0187fc2da8876e903e36 /libavcodec/aacdec.c | |
| parent | be90f0279d0784c396407e152a8d817953381886 (diff) | |
| parent | 42fed7f433e6d2167ffd4aae31905b583a53b988 (diff) | |
| download | ffmpeg-7118358a950e20a4439d796f16892b27dad6c754.tar.gz | |
Merge commit '42fed7f433e6d2167ffd4aae31905b583a53b988' into release/0.10
* commit '42fed7f433e6d2167ffd4aae31905b583a53b988':
wavpack: check packet size early
mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac
mjpeg: Validate sampling factors
ljpeg: use the correct number of components in yuv
wavpack: validate samples size parsed in wavpack_decode_block
jpegls: check the scan offset
jpegls: factorize return paths
jpegls: return meaningful errors
mjpegdec: properly report unsupported disabled features
update Changelog
proresdec: support mixed interlaced/non-interlaced content
update Changelog
wav: Always seek to an even offset
id3v2: check for end of file while unescaping tags
indeo3: fix off by one in MV validity check
aac: check the maximum number of channels
update Changelog
oggdec: fix faulty cleanup prototype
Conflicts:
Changelog
libavcodec/jpeglsdec.c
libavcodec/mjpegdec.c
libavformat/id3v2.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/aacdec.c')
| -rw-r--r-- | libavcodec/aacdec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index a592c50585..6249619b42 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -192,6 +192,8 @@ static av_cold int che_configure(AACContext *ac, enum ChannelPosition che_pos[4][MAX_ELEM_ID], int type, int id, int *channels) { + if (*channels >= MAX_CHANNELS) + return AVERROR_INVALIDDATA; if (che_pos[type][id]) { if (!ac->che[type][id]) { if (!(ac->che[type][id] = av_mallocz(sizeof(ChannelElement)))) |