diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-02-28 22:53:20 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-02-28 22:54:55 +0100 |
| commit | f929abd0c3643b28a9552512d698cf61ad4d08fa (patch) | |
| tree | fe411a2380977d29be950b851d461e0bbe167398 /libavcodec | |
| parent | 34210e8df1458da556998ad6bbcabc78f4d15ffb (diff) | |
| download | ffmpeg-f929abd0c3643b28a9552512d698cf61ad4d08fa.tar.gz | |
adpcm_xa: Check filter validity.
Fixes out of global array read.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/adpcm.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index 19289e8021..54c1dc6983 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -277,6 +277,10 @@ static void xa_decode(short *out, const unsigned char *in, shift = 12 - (in[4+i*2] & 15); filter = in[4+i*2] >> 4; + if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table)) { + av_log_ask_for_sample(NULL, "unknown filter %d\n", filter); + filter=0; + } f0 = xa_adpcm_table[filter][0]; f1 = xa_adpcm_table[filter][1]; @@ -304,6 +308,10 @@ static void xa_decode(short *out, const unsigned char *in, shift = 12 - (in[5+i*2] & 15); filter = in[5+i*2] >> 4; + if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table)) { + av_log_ask_for_sample(NULL, "unknown filter %d\n", filter); + filter=0; + } f0 = xa_adpcm_table[filter][0]; f1 = xa_adpcm_table[filter][1]; |