diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-12-14 01:12:56 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-12-14 01:13:21 +0100 |
| commit | a974adc3c78c4bcf62dd2a10ff1ae8eae6fa29ef (patch) | |
| tree | 898bfd49fd102dc2146469d04771017a1da097d0 /libavcodec/g729dec.c | |
| parent | 56d09250ef44eebd04f6d4cf6c6f5bfbe46b01dc (diff) | |
| download | ffmpeg-a974adc3c78c4bcf62dd2a10ff1ae8eae6fa29ef.tar.gz | |
g729dec: check pitch_delay_int.
Fix out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/g729dec.c')
| -rw-r--r-- | libavcodec/g729dec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/g729dec.c b/libavcodec/g729dec.c index b44120fd85..db3f013f32 100644 --- a/libavcodec/g729dec.c +++ b/libavcodec/g729dec.c @@ -510,6 +510,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr, /* Round pitch delay to nearest (used everywhere except ff_acelp_interpolate). */ pitch_delay_int[i] = (pitch_delay_3x + 1) / 3; + if (pitch_delay_int[i] > PITCH_DELAY_MAX) { + av_log(avctx, AV_LOG_WARNING, "pitch_delay_int %d is too large\n", pitch_delay_int[i]); + pitch_delay_int[i] = PITCH_DELAY_MAX; + } if (frame_erasure) { ctx->rand_value = g729_prng(ctx->rand_value); |