Mercurial > libavcodec.hg

changeset 11304:3ef04d1190f0 libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fixed a segfault in the DCA decoder with corrupted streams. It happens when the number of channels defined by DCAContext:acmod is lower than DCAContext:prim_channels. In this case, dca_subsubframe() will call qmf_32_subbands() using s->channel_order_tab[] entries equal to -1.
author fenrir
date Fri, 26 Feb 2010 18:50:01 +0000
parents b0cb1f7efcbc
children 1a349d669184
files dca.c
diffstat 1 files changed, 4 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/dca.c	Fri Feb 26 18:12:27 2010 +0000
+++ b/dca.c	Fri Feb 26 18:50:01 2010 +0000
@@ -1244,6 +1244,10 @@
         } else
             s->channel_order_tab = dca_channel_reorder_nolfe[s->amode];
 
+        if (s->prim_channels > 0 &&
+            s->channel_order_tab[s->prim_channels - 1] < 0)
+            return -1;
+
         if(avctx->request_channels == 2 && s->prim_channels > 2) {
             channels = 2;
             s->output = DCA_STEREO;