diff options
| author | Google Chrome <> | 2010-02-09 19:50:47 +0000 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2010-02-09 19:50:47 +0000 |
| commit | dc5cc27d5ade462e7b2aa617285a4d64ee4000d7 (patch) | |
| tree | 5d5fe491b08db5418a9606fd345928eb99040a93 | |
| parent | eb70d77e1ebe3104b83506dcb5708b581bb09a00 (diff) | |
Check masterbook index and subclass book index.
14_floor_masterbook_index.patch by chrome
r19991 by michael
Originally committed as revision 21727 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
| -rw-r--r-- | libavcodec/vorbis_dec.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/libavcodec/vorbis_dec.c b/libavcodec/vorbis_dec.c index bd8002eaf6..cfcb29c42d 100644 --- a/libavcodec/vorbis_dec.c +++ b/libavcodec/vorbis_dec.c @@ -492,13 +492,23 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc) { AV_DEBUG(" %d floor %d class dim: %d subclasses %d \n", i, j, floor_setup->data.t1.class_dimensions[j], floor_setup->data.t1.class_subclasses[j]); if (floor_setup->data.t1.class_subclasses[j]) { - floor_setup->data.t1.class_masterbook[j]=get_bits(gb, 8); + int bits=get_bits(gb, 8); + if (bits>=vc->codebook_count) { + av_log(vc->avccontext, AV_LOG_ERROR, "Masterbook index %d is out of range.\n", bits); + return 1; + } + floor_setup->data.t1.class_masterbook[j]=bits; AV_DEBUG(" masterbook: %d \n", floor_setup->data.t1.class_masterbook[j]); } for(k=0;k<(1<<floor_setup->data.t1.class_subclasses[j]);++k) { - floor_setup->data.t1.subclass_books[j][k]=(int16_t)get_bits(gb, 8)-1; + int16_t bits=get_bits(gb, 8)-1; + if (bits!=-1 && bits>=vc->codebook_count) { + av_log(vc->avccontext, AV_LOG_ERROR, "Subclass book index %d is out of range.\n", bits); + return 1; + } + floor_setup->data.t1.subclass_books[j][k]=bits; AV_DEBUG(" book %d. : %d \n", k, floor_setup->data.t1.subclass_books[j][k]); } |