ac3: detect dba errors and prevent writing past end of array

Originally committed as revision 16034 to svn://svn.ffmpeg.org/ffmpeg/trunk

1 files changed, 5 insertions, 2 deletions

diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c
index 291d8f3ab4..c7c240cdb4 100644
--- a/libavcodec/ac3dec.c
+++ b/libavcodec/ac3dec.c
@@ -1133,12 +1133,15 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
         if(bit_alloc_stages[ch] > 1) {
             /* Compute excitation function, Compute masking curve, and
                Apply delta bit allocation */
-            ff_ac3_bit_alloc_calc_mask(&s->bit_alloc_params, s->band_psd[ch],
+            if (ff_ac3_bit_alloc_calc_mask(&s->bit_alloc_params, s->band_psd[ch],
                                        s->start_freq[ch], s->end_freq[ch],
                                        s->fast_gain[ch], (ch == s->lfe_ch),
                                        s->dba_mode[ch], s->dba_nsegs[ch],
                                        s->dba_offsets[ch], s->dba_lengths[ch],
-                                       s->dba_values[ch], s->mask[ch]);
+                                       s->dba_values[ch], s->mask[ch])) {
+                av_log(s->avctx, AV_LOG_ERROR, "error in bit allocation\n");
+                return -1;
+            }
         }
         if(bit_alloc_stages[ch] > 0) {
             /* Compute bit allocation */