diff options
| author | Justin Ruggles <justin.ruggles@gmail.com> | 2014-06-22 13:11:32 -0400 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2014-06-26 12:51:04 +0200 |
| commit | 7997acee0542f6e0bb9ea42ff783f80b70878a2f (patch) | |
| tree | 54844b5cba2147f69b2ca656e6a026fdb1f7e592 /libavcodec | |
| parent | 503322f97c5a25a020933ed4ab510697d5f5b4af (diff) | |
| download | ffmpeg-7997acee0542f6e0bb9ea42ff783f80b70878a2f.tar.gz | |
Check if an mp3 header is using a reserved sample rate.
Fixes an invalid read past the end of avpriv_mpa_freq_tab.
Fixes divide-by-zero due to sample_rate being set to 0.
Bug-Id: 705
CC:libav-stable@libav.org
Conflicts:
libavcodec/mpegaudiodecheader.c
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/mpegaudiodecheader.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/mpegaudiodecheader.c b/libavcodec/mpegaudiodecheader.c index f8fc833124..e789d467b0 100644 --- a/libavcodec/mpegaudiodecheader.c +++ b/libavcodec/mpegaudiodecheader.c @@ -25,6 +25,8 @@ */ //#define DEBUG +#include "libavutil/common.h" + #include "avcodec.h" #include "mpegaudio.h" #include "mpegaudiodata.h" @@ -46,6 +48,8 @@ int avpriv_mpegaudio_decode_header(MPADecodeHeader *s, uint32_t header) s->layer = 4 - ((header >> 17) & 3); /* extract frequency */ sample_rate_index = (header >> 10) & 3; + if (sample_rate_index >= FF_ARRAY_ELEMS(avpriv_mpa_freq_tab)) + sample_rate_index = 0; sample_rate = avpriv_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25); sample_rate_index += 3 * (s->lsf + mpeg25); s->sample_rate_index = sample_rate_index; |