diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-26 15:26:14 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-26 15:26:14 +0200 |
| commit | fe91becc2dcf32fc4bc56b00b4533d34ec3d27f5 (patch) | |
| tree | 48151cfba1e645781c42fd529e5139bc3ad06efe /libavcodec/qdm2.c | |
| parent | 7d74aaf6985e0f286e10c851e4d7e80fd687a774 (diff) | |
qdm2: fix out of array read
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/qdm2.c')
| -rw-r--r-- | libavcodec/qdm2.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c index 91f50556dd..3868473828 100644 --- a/libavcodec/qdm2.c +++ b/libavcodec/qdm2.c @@ -884,9 +884,12 @@ static int synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int le break; case 30: - if (BITS_LEFT(length,gb) >= 4) - samples[0] = type30_dequant[qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1)]; - else + if (BITS_LEFT(length,gb) >= 4) { + unsigned v = qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1); + if (v >= FF_ARRAY_ELEMS(type30_dequant)) + return AVERROR_INVALIDDATA; + samples[0] = type30_dequant[v]; + } else samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx); run = 1; |