diff options
| author | Alex Converse <alex.converse@gmail.com> | 2010-03-09 21:50:10 +0000 |
|---|---|---|
| committer | Alex Converse <alex.converse@gmail.com> | 2010-03-09 21:50:10 +0000 |
| commit | 6ebc7240606e8f1fccd2edbe4ffac150053a16cc (patch) | |
| tree | 99a3c2762a85717b3ff4993905737e98c007caa7 /libavcodec/aacsbr.c | |
| parent | 134b8cbb9a9a0347bdd81ee4cfc2c3e45c095a17 (diff) | |
| download | ffmpeg-6ebc7240606e8f1fccd2edbe4ffac150053a16cc.tar.gz | |
aacsbr: Check that bs_num_env is valid before writing arrays with it as an offset.
Originally committed as revision 22413 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/aacsbr.c')
| -rw-r--r-- | libavcodec/aacsbr.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/aacsbr.c b/libavcodec/aacsbr.c index 59517b1b38..6915152eca 100644 --- a/libavcodec/aacsbr.c +++ b/libavcodec/aacsbr.c @@ -689,7 +689,6 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr, num_rel_lead = get_bits(gb, 2); num_rel_trail = get_bits(gb, 2); ch_data->bs_num_env = num_rel_lead + num_rel_trail + 1; - ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail; if (ch_data->bs_num_env > 5) { av_log(ac->avccontext, AV_LOG_ERROR, @@ -698,6 +697,8 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr, return -1; } + ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail; + for (i = 0; i < num_rel_lead; i++) ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2; for (i = 0; i < num_rel_trail; i++) |