diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-02-29 06:10:17 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-02-29 06:20:07 +0100 |
| commit | 8534881a389044ec51adabcf979616b4875ac072 (patch) | |
| tree | 1edfece2f16d1c71102c2482c50cf2b9c0558be5 /libavcodec/alsdec.c | |
| parent | f5bf7b9f4baf9f4626146f996df47c1d37517024 (diff) | |
alsdec: Check that quantized parcor coeffs are within range.
ALS spec:
11.6.3.1.1 Quantization and encoding of parcor coefficients
...
In all cases the resulting quantized values ak are restricted to the range [-64,63].
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/alsdec.c')
| -rw-r--r-- | libavcodec/alsdec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 84ed4cf403..8abba606a8 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -695,6 +695,10 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) int rice_param = parcor_rice_table[sconf->coef_table][k][1]; int offset = parcor_rice_table[sconf->coef_table][k][0]; quant_cof[k] = decode_rice(gb, rice_param) + offset; + if (quant_cof[k] < -64 || quant_cof[k] > 63) { + av_log(avctx, AV_LOG_ERROR, "quant_cof %d is out of range\n", quant_cof[k]); + return AVERROR_INVALIDDATA; + } } // read coefficients 20 to 126 |