diff options
| author | Alex Converse <alex.converse@gmail.com> | 2012-06-04 18:27:03 -0700 |
|---|---|---|
| committer | Alex Converse <alex.converse@gmail.com> | 2012-06-05 09:51:51 -0700 |
| commit | ecf79c4d3e8baaf2f303278ef81db6f8407656bc (patch) | |
| tree | 5a0f45fbc87f874fc2194128f37361fc23074657 /libavcodec/vorbisenc.c | |
| parent | 503f2feb143b58bf9b7850ef00ec0bb02d509f78 (diff) | |
| download | ffmpeg-ecf79c4d3e8baaf2f303278ef81db6f8407656bc.tar.gz | |
vorbis: Validate that the floor 1 X values contain no duplicates.
Duplicate values in this vector are explicitly banned by the Vorbis I spec
and cause divide-by-zero crashes later on.
Diffstat (limited to 'libavcodec/vorbisenc.c')
| -rw-r--r-- | libavcodec/vorbisenc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/vorbisenc.c b/libavcodec/vorbisenc.c index 0b0caccb7c..173619ae4b 100644 --- a/libavcodec/vorbisenc.c +++ b/libavcodec/vorbisenc.c @@ -340,7 +340,8 @@ static int create_vorbis_context(vorbis_enc_context *venc, }; fc->list[i].x = a[i - 2]; } - ff_vorbis_ready_floor1_list(fc->list, fc->values); + if (ff_vorbis_ready_floor1_list(avccontext, fc->list, fc->values)) + return AVERROR_BUG; venc->nresidues = 1; venc->residues = av_malloc(sizeof(vorbis_enc_residue) * venc->nresidues); |