wavpack: check K, fix assertion failure

Instead of this it would be possible to change the code to support
larger K but that would make the code slower and probably still need
checks on K.
This variant is choosen as there are no known valid files that need
larger K

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 4 insertions, 0 deletions

diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c
index b30b41414b..481d323bc4 100644
--- a/libavcodec/wavpack.c
+++ b/libavcodec/wavpack.c
@@ -373,6 +373,10 @@ static int wv_get_value(WavpackFrameContext *ctx, GetBitContext *gb,
         INC_MED(2);
     }
     if (!c->error_limit) {
+        if (add >= 0x2000000U) {
+            av_log(ctx->avctx, AV_LOG_ERROR, "k %d is too large\n", add);
+            goto error;
+        }
         ret = base + get_tail(gb, add);
         if (get_bits_left(gb) <= 0)
             goto error;