diff options
| author | Aaron Colwell <acolwell@chromium.org> | 2012-03-07 14:51:00 -0800 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-08 11:52:33 -0800 |
| commit | 12623a8026c1657aedce2ef10d58bffba85dee2d (patch) | |
| tree | 7f5641a76f392877ebeede3eb6386402d901f2ed /libavcodec/vorbisdec.c | |
| parent | ef0d779706c77ca9007527bd8d41e9400682f4e4 (diff) | |
vorbisdec: avoid invalid memory access
This fixes some invalid memory access caused later in the function
by res_chan[] not being set for all channels. This happens when a
channel doesn't appear a submap. This change simply returns a
decoder error when this situation is detected.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
Diffstat (limited to 'libavcodec/vorbisdec.c')
| -rw-r--r-- | libavcodec/vorbisdec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c index 0d491c82dd..4a7d6097b1 100644 --- a/libavcodec/vorbisdec.c +++ b/libavcodec/vorbisdec.c @@ -1581,6 +1581,9 @@ static int vorbis_parse_audio_packet(vorbis_context *vc) ch_left -= ch; } + if (ch_left > 0) + return AVERROR_INVALIDDATA; + // Inverse coupling for (i = mapping->coupling_steps - 1; i >= 0; --i) { //warning: i has to be signed |