mlpdec: Validate max_channel and max_matrix_channel.

Originally committed as revision 18649 to svn://svn.ffmpeg.org/ffmpeg/trunk

2 files changed, 19 insertions, 0 deletions

diff --git a/libavcodec/mlp.h b/libavcodec/mlp.h
index 433f95f6eb..910d819cd9 100644
--- a/libavcodec/mlp.h
+++ b/libavcodec/mlp.h
@@ -26,6 +26,9 @@
 
 #include "avcodec.h"
 
+/** Last possible matrix channel for each codec */
+#define MAX_MATRIX_CHANNEL_MLP      5
+#define MAX_MATRIX_CHANNEL_TRUEHD   7
 /** Maximum number of channels that can be decoded. */
 #define MAX_CHANNELS        16
 
diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
index 493296098a..540d2ed833 100644
--- a/libavcodec/mlpdec.c
+++ b/libavcodec/mlpdec.c
@@ -335,6 +335,9 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
     uint8_t checksum;
     uint8_t lossless_check;
     int start_count = get_bits_count(gbp);
+    const int max_matrix_channel = m->avctx->codec_id == CODEC_ID_MLP
+                                 ? MAX_MATRIX_CHANNEL_MLP
+                                 : MAX_MATRIX_CHANNEL_TRUEHD;
 
     sync_word = get_bits(gbp, 13);
     s->noise_type = get_bits1(gbp);
@@ -352,6 +355,19 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
     s->max_channel        = get_bits(gbp, 4);
     s->max_matrix_channel = get_bits(gbp, 4);
 
+    if (s->max_matrix_channel > max_matrix_channel) {
+        av_log(m->avctx, AV_LOG_ERROR,
+               "Max matrix channel cannot be greater than %d.\n",
+               max_matrix_channel);
+        return -1;
+    }
+
+    if (s->max_channel != s->max_matrix_channel) {
+        av_log(m->avctx, AV_LOG_ERROR,
+               "Max channel must be equal max matrix channel.\n");
+        return -1;
+    }
+
     if (s->min_channel > s->max_channel) {
         av_log(m->avctx, AV_LOG_ERROR,
                "Substream min channel cannot be greater than max channel.\n");