diff options
| author | Oana Stratulat <oanaandreeastratulat@gmail.com> | 2012-01-05 01:08:05 +0200 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2012-01-04 21:33:14 -0800 |
| commit | 7f09791d28c82c9169d1612a6192851837341ca9 (patch) | |
| tree | 35ee2f8c6bc338159144627d92a2d2a863bb26ce /libavcodec/amrnbdec.c | |
| parent | 3fa646e8590cf86d3006e76047daa255a7ecc3f7 (diff) | |
Report an error if pitch_lag is zero in AMR-NB decoder.
This fixes an infinite loop in the decoder on specially
crafted files, and fixes bug 151.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
Diffstat (limited to 'libavcodec/amrnbdec.c')
| -rw-r--r-- | libavcodec/amrnbdec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/amrnbdec.c b/libavcodec/amrnbdec.c index 926014f83c..fff0e7248a 100644 --- a/libavcodec/amrnbdec.c +++ b/libavcodec/amrnbdec.c @@ -977,6 +977,10 @@ static int amrnb_decode_frame(AVCodecContext *avctx, void *data, pitch_sharpening(p, subframe, p->cur_frame_mode, &fixed_sparse); + if (fixed_sparse.pitch_lag == 0) { + av_log(avctx, AV_LOG_ERROR, "The file is corrupted, pitch_lag = 0 is not allowed\n"); + return AVERROR_INVALIDDATA; + } ff_set_fixed_vector(p->fixed_vector, &fixed_sparse, 1.0, AMR_SUBFRAME_SIZE); |