diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-14 20:49:25 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-14 20:55:59 +0200 |
| commit | a6a45774d045007f8262cd7c614804390e53122e (patch) | |
| tree | fe9f1253dbebab02de4cd98fa5795f8e63df1b19 /libavcodec | |
| parent | cc5e4bb48476a89cc8ce0c41bc2bd2e8fda9b37c (diff) | |
| download | ffmpeg-a6a45774d045007f8262cd7c614804390e53122e.tar.gz | |
avcodec/dcadec: Check nchans
Fixes CID1239110
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/dcadec.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c index bd534261b7..f385db558c 100644 --- a/libavcodec/dcadec.c +++ b/libavcodec/dcadec.c @@ -229,6 +229,14 @@ static int dca_parse_audio_coding_header(DCAContext *s, int base_channel, } nchans = get_bits(&s->gb, 3) + 1; + if (xxch && nchans >= 3) { + av_log(s->avctx, AV_LOG_ERROR, "nchans %d is too large\n", nchans); + return AVERROR_INVALIDDATA; + } else if (nchans + base_channel > DCA_PRIM_CHANNELS_MAX) { + av_log(s->avctx, AV_LOG_ERROR, "channel sum %d + %d is too large\n", nchans, base_channel); + return AVERROR_INVALIDDATA; + } + s->total_channels = nchans + base_channel; s->prim_channels = s->total_channels; |