diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2010-02-26 18:50:01 +0000 |
|---|---|---|
| committer | Laurent Aimar <fenrir@videolan.org> | 2010-02-26 18:50:01 +0000 |
| commit | 4e06acbde4a75cf9aa6a3e46dd3a7c6ed1ecfb8f (patch) | |
| tree | c68c067b3e2f25d8b4fa7cc9322479bcfdf132c0 /libavcodec | |
| parent | 4784b0922febe020c31e0fc6b37dd8b4d86b28f0 (diff) | |
| download | ffmpeg-4e06acbde4a75cf9aa6a3e46dd3a7c6ed1ecfb8f.tar.gz | |
Fixed a segfault in the DCA decoder with corrupted streams.
It happens when the number of channels defined by DCAContext:acmod is lower
than DCAContext:prim_channels. In this case, dca_subsubframe() will call
qmf_32_subbands() using s->channel_order_tab[] entries equal to -1.
Originally committed as revision 22083 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/dca.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/dca.c b/libavcodec/dca.c index 20d7144c2c..e10ced7221 100644 --- a/libavcodec/dca.c +++ b/libavcodec/dca.c @@ -1244,6 +1244,10 @@ static int dca_decode_frame(AVCodecContext * avctx, } else s->channel_order_tab = dca_channel_reorder_nolfe[s->amode]; + if (s->prim_channels > 0 && + s->channel_order_tab[s->prim_channels - 1] < 0) + return -1; + if(avctx->request_channels == 2 && s->prim_channels > 2) { channels = 2; s->output = DCA_STEREO; |