diff options
author | Justin Ruggles <justin.ruggles@gmail.com> | 2013-02-20 11:41:20 -0500 |
---|---|---|
committer | Justin Ruggles <justin.ruggles@gmail.com> | 2013-02-23 16:59:39 -0500 |
commit | d7c450436fcb9d3ecf59884a574e7684183e753d (patch) | |
tree | b28b5f3475e03ee1905cb1e55ce78a1574c4b0d6 /libavcodec | |
parent | 82ca17ac7a0a08784cb6808384ee237ac28e8334 (diff) | |
download | ffmpeg-d7c450436fcb9d3ecf59884a574e7684183e753d.tar.gz |
ac3dec: validate channel output mode against channel count
Damaged frames can lead to a mismatch, which can cause a segfault
due to using an incorrect channel mapping.
CC:libav-stable@libav.org
Diffstat (limited to 'libavcodec')
-rw-r--r-- | libavcodec/ac3dec.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index 8d9fe5a73c..f8f058477f 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -1336,8 +1336,10 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data, if (!err) { avctx->sample_rate = s->sample_rate; avctx->bit_rate = s->bit_rate; + } - /* channel config */ + /* channel config */ + if (!err || (s->channels && s->out_channels != s->channels)) { s->out_channels = s->channels; s->output_mode = s->channel_mode; if (s->lfe_on) @@ -1356,18 +1358,18 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data, s->fbw_channels == s->out_channels)) { set_downmix_coeffs(s); } - } else if (!s->out_channels) { - s->out_channels = avctx->channels; - if (s->out_channels < s->channels) - s->output_mode = s->out_channels == 1 ? AC3_CHMODE_MONO : AC3_CHMODE_STEREO; + } else if (!s->channels) { + av_log(avctx, AV_LOG_ERROR, "unable to determine channel mode\n"); + return AVERROR_INVALIDDATA; } + avctx->channels = s->out_channels; + /* set audio service type based on bitstream mode for AC-3 */ avctx->audio_service_type = s->bitstream_mode; if (s->bitstream_mode == 0x7 && s->channels > 1) avctx->audio_service_type = AV_AUDIO_SERVICE_TYPE_KARAOKE; /* get output buffer */ - avctx->channels = s->out_channels; frame->nb_samples = s->num_blocks * 256; if ((ret = ff_get_buffer(avctx, frame)) < 0) { av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); |