diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-01-07 13:57:47 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-07 14:02:53 +0100 |
| commit | 8ca9a68f1905ff871690be38348d62a25aef2a8f (patch) | |
| tree | 021a13b9741891953c1259b2c01fc81f12d50952 /libavcodec | |
| parent | 77274d5c79a1cf74f1bd9773c1beda554dc90cb2 (diff) | |
| download | ffmpeg-8ca9a68f1905ff871690be38348d62a25aef2a8f.tar.gz | |
avcodec/flacdec: check rice_order against blocksize
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f6e13c220d0_8489_short.flac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/flacdec.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/flacdec.c b/libavcodec/flacdec.c index 596b24d76d..f63a918b1b 100644 --- a/libavcodec/flacdec.c +++ b/libavcodec/flacdec.c @@ -221,6 +221,12 @@ static int decode_residuals(FLACContext *s, int32_t *decoded, int pred_order) rice_order = get_bits(&s->gb, 4); samples= s->blocksize >> rice_order; + if (samples << rice_order != s->blocksize) { + av_log(s->avctx, AV_LOG_ERROR, "invalid rice order: %i blocksize %i\n", + rice_order, s->blocksize); + return AVERROR_INVALIDDATA; + } + if (pred_order > samples) { av_log(s->avctx, AV_LOG_ERROR, "invalid predictor order: %i > %i\n", pred_order, samples); |