diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-20 00:19:39 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-20 00:20:03 +0100 |
| commit | c69315a5deb0f8095e6b4746b69171d6f3059b2f (patch) | |
| tree | 19c04e4f5c1b749da99e48ae40df93e7b85dbb54 /libavcodec | |
| parent | a5153b1d1692e51cf69ff28bc6a25ce5241774e0 (diff) | |
| download | ffmpeg-c69315a5deb0f8095e6b4746b69171d6f3059b2f.tar.gz | |
cook: check js_subband_start for validity
Fixes out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/cook.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/cook.c b/libavcodec/cook.c index 54b576f89f..7dcf6558ec 100644 --- a/libavcodec/cook.c +++ b/libavcodec/cook.c @@ -1091,6 +1091,11 @@ static av_cold int cook_decode_init(AVCodecContext *avctx) if (extradata_size >= 8) { bytestream_get_be32(&edata_ptr); // Unknown unused q->subpacket[s].js_subband_start = bytestream_get_be16(&edata_ptr); + if (q->subpacket[s].js_subband_start >= 51) { + av_log(avctx, AV_LOG_ERROR, "js_subband_start %d is too large\n", q->subpacket[s].js_subband_start); + return AVERROR_INVALIDDATA; + } + q->subpacket[s].js_vlc_bits = bytestream_get_be16(&edata_ptr); extradata_size -= 8; } |