Mercurial > libavcodec.hg
changeset 6463:9f397992ddff libavcodec
Don't use unchecked data from the bitstream.
| author | banan |
|---|---|
| date | Thu, 06 Mar 2008 14:22:02 +0000 |
| parents | 745a4216b352 |
| children | 0c3cc1d7a0b3 |
| files | dca.c |
| diffstat | 1 files changed, 10 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- a/dca.c Thu Mar 06 09:45:59 2008 +0000 +++ b/dca.c Thu Mar 06 14:22:02 2008 +0000 @@ -125,6 +125,7 @@ /* Primary audio coding header */ int subframes; ///< number of subframes + int total_channels; ///< number of channels including extensions int prim_channels; ///< number of primary audio channels int subband_activity[DCA_PRIM_CHANNELS_MAX]; ///< subband activity count int vq_start_subband[DCA_PRIM_CHANNELS_MAX]; ///< high frequency vq start subband @@ -320,7 +321,10 @@ /* Primary audio coding header */ s->subframes = get_bits(&s->gb, 4) + 1; - s->prim_channels = get_bits(&s->gb, 3) + 1; + s->total_channels = get_bits(&s->gb, 3) + 1; + s->prim_channels = s->total_channels; + if (s->prim_channels > DCA_PRIM_CHANNELS_MAX) + s->prim_channels = DCA_PRIM_CHANNELS_MAX; /* We only support DTS core */ for (i = 0; i < s->prim_channels; i++) { @@ -427,7 +431,11 @@ s->bitalloc[j][k] = get_bits(&s->gb, 5); else if (s->bitalloc_huffman[j] == 5) s->bitalloc[j][k] = get_bits(&s->gb, 4); - else { + else if (s->bitalloc_huffman[j] == 7) { + av_log(s->avctx, AV_LOG_ERROR, + "Invalid bit allocation index\n"); + return -1; + } else { s->bitalloc[j][k] = get_bitalloc(&s->gb, &dca_bitalloc_index, s->bitalloc_huffman[j]); }