diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-06-07 20:50:38 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-06-07 21:10:22 +0200 |
| commit | c36fc857b5a8f8bdf2bcc54ce72bbf817902edcf (patch) | |
| tree | 3cd4a936a8e067e169915d8c556f9119f724cecb /libavcodec/alsdec.c | |
| parent | 1748eb02c8f3ab6daf40ef1fb47773cea2bceab3 (diff) | |
| download | ffmpeg-c36fc857b5a8f8bdf2bcc54ce72bbf817902edcf.tar.gz | |
avcodec/alsdec: Check r to prevent out of array read
No testcase known
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/alsdec.c')
| -rw-r--r-- | libavcodec/alsdec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 842fc7dc76..a7e58a242f 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -767,6 +767,11 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) r = get_unary(gb, 0, 4); c = get_bits(gb, 2); + if (r >= 4) { + av_log(avctx, AV_LOG_ERROR, "r overflow\n"); + return AVERROR_INVALIDDATA; + } + bd->ltp_gain[2] = ltp_gain_values[r][c]; bd->ltp_gain[3] = decode_rice(gb, 2) << 3; |