aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2012-11-14 21:14:40 +0100
committerMichael Niedermayer <michaelni@gmx.at>2012-11-14 21:15:08 +0100
commit50f0a6b4e64b78e0df1919ee1fa5e805309911c2 (patch)
tree4af5e8a5affeef33eef7dec9039b2b1d21f5302d /libavcodec
parent30bce34b6719ca99ad72c62e2fba3eade71f1eae (diff)
downloadffmpeg-50f0a6b4e64b78e0df1919ee1fa5e805309911c2.tar.gz
wmaprodec: check num_sfb for validity. Fix out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
-rw-r--r--libavcodec/wmaprodec.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c
index e071eb1f95..c5cc46b5ce 100644
--- a/libavcodec/wmaprodec.c
+++ b/libavcodec/wmaprodec.c
@@ -412,6 +412,10 @@ static av_cold int decode_init(AVCodecContext *avctx)
}
s->sfb_offsets[i][band - 1] = subframe_len;
s->num_sfb[i] = band - 1;
+ if (s->num_sfb[i] <= 0) {
+ av_log(avctx, AV_LOG_ERROR, "num_sfb invalid\n");
+ return AVERROR_INVALIDDATA;
+ }
}