aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/dcadec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2015-05-14 20:49:25 +0200
committerMichael Niedermayer <michaelni@gmx.at>2015-05-14 20:55:59 +0200
commita6a45774d045007f8262cd7c614804390e53122e (patch)
treefe9f1253dbebab02de4cd98fa5795f8e63df1b19 /libavcodec/dcadec.c
parentcc5e4bb48476a89cc8ce0c41bc2bd2e8fda9b37c (diff)
downloadffmpeg-a6a45774d045007f8262cd7c614804390e53122e.tar.gz
avcodec/dcadec: Check nchans
Fixes CID1239110 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/dcadec.c')
-rw-r--r--libavcodec/dcadec.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c
index bd534261b7..f385db558c 100644
--- a/libavcodec/dcadec.c
+++ b/libavcodec/dcadec.c
@@ -229,6 +229,14 @@ static int dca_parse_audio_coding_header(DCAContext *s, int base_channel,
}
nchans = get_bits(&s->gb, 3) + 1;
+ if (xxch && nchans >= 3) {
+ av_log(s->avctx, AV_LOG_ERROR, "nchans %d is too large\n", nchans);
+ return AVERROR_INVALIDDATA;
+ } else if (nchans + base_channel > DCA_PRIM_CHANNELS_MAX) {
+ av_log(s->avctx, AV_LOG_ERROR, "channel sum %d + %d is too large\n", nchans, base_channel);
+ return AVERROR_INVALIDDATA;
+ }
+
s->total_channels = nchans + base_channel;
s->prim_channels = s->total_channels;