Mercurial > libavcodec.hg
comparison aacsbr.c @ 11450:95123a24a580 libavcodec
aacsbr: Check that bs_num_env is valid before writing arrays with it as an offset.
| author | alexc |
|---|---|
| date | Tue, 09 Mar 2010 21:50:10 +0000 |
| parents | e62f45fd47d4 |
| children | 96dde15b2e0d |
comparison
equal
deleted
inserted
replaced
| 11449:e62f45fd47d4 | 11450:95123a24a580 |
|---|---|
| 687 ch_data->t_env[0] = get_bits(gb, 2); | 687 ch_data->t_env[0] = get_bits(gb, 2); |
| 688 abs_bord_trail += get_bits(gb, 2); | 688 abs_bord_trail += get_bits(gb, 2); |
| 689 num_rel_lead = get_bits(gb, 2); | 689 num_rel_lead = get_bits(gb, 2); |
| 690 num_rel_trail = get_bits(gb, 2); | 690 num_rel_trail = get_bits(gb, 2); |
| 691 ch_data->bs_num_env = num_rel_lead + num_rel_trail + 1; | 691 ch_data->bs_num_env = num_rel_lead + num_rel_trail + 1; |
| 692 ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail; | |
| 693 | 692 |
| 694 if (ch_data->bs_num_env > 5) { | 693 if (ch_data->bs_num_env > 5) { |
| 695 av_log(ac->avccontext, AV_LOG_ERROR, | 694 av_log(ac->avccontext, AV_LOG_ERROR, |
| 696 "Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n", | 695 "Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n", |
| 697 ch_data->bs_num_env); | 696 ch_data->bs_num_env); |
| 698 return -1; | 697 return -1; |
| 699 } | 698 } |
| 699 | |
| 700 ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail; | |
| 700 | 701 |
| 701 for (i = 0; i < num_rel_lead; i++) | 702 for (i = 0; i < num_rel_lead; i++) |
| 702 ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2; | 703 ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2; |
| 703 for (i = 0; i < num_rel_trail; i++) | 704 for (i = 0; i < num_rel_trail; i++) |
| 704 ch_data->t_env[ch_data->bs_num_env - 1 - i] = | 705 ch_data->t_env[ch_data->bs_num_env - 1 - i] = |