diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-10 19:29:39 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-15 12:30:40 +0100 |
| commit | e5567f2f6982e765c6d477b2cb6b8f9f6a4d77ab (patch) | |
| tree | e20de2c93ee0d33ad5d11250f5f3d3d8ea42045e /libavcodec | |
| parent | b8382a1faeb24662eb9197d32b1bae434a803daa (diff) | |
| download | ffmpeg-e5567f2f6982e765c6d477b2cb6b8f9f6a4d77ab.tar.gz | |
avcodec/aacdec_template: Check id_map
Fixes index out of bounds error
Fixes: aac_index_out_of_bounds.wmv
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 590863876d1478547640304a31c15809c3618090)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/aacdec_template.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c index fb1ce2cb06..ec8264e5f1 100644 --- a/libavcodec/aacdec_template.c +++ b/libavcodec/aacdec_template.c @@ -449,6 +449,10 @@ static int output_configure(AACContext *ac, int type = layout_map[i][0]; int id = layout_map[i][1]; id_map[type][id] = type_counts[type]++; + if (id_map[type][id] >= MAX_ELEM_ID) { + avpriv_request_sample(ac->avctx, "Remapped id too large\n"); + return AVERROR_PATCHWELCOME; + } } // Try to sniff a reasonable channel order, otherwise output the // channels in the order the PCE declared them. |