diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-14 13:34:14 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-04-14 13:35:29 +0200 |
| commit | d442c4462a2692e27a24e1a9d0eb6f18725c7bd8 (patch) | |
| tree | d3c8bbd6ab5798bf276bfcebf14e2cd91d05cdf3 /libavcodec/wmalosslessdec.c | |
| parent | 9166f483c52e7e0a031a7bb149bea16aaa72f344 (diff) | |
wmalosslessdec: Make arrays WMALL_BLOCK_MAX_SIZE big and check samples_per_frame.
The samples_per_frame check is ported from wmaprodec.c
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/wmalosslessdec.c')
| -rw-r--r-- | libavcodec/wmalosslessdec.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c index e5114436e6..374dc7464c 100644 --- a/libavcodec/wmalosslessdec.c +++ b/libavcodec/wmalosslessdec.c @@ -157,14 +157,14 @@ typedef struct WmallDecodeCtx { int ave_sum[2]; - int channel_residues[2][2048]; + int channel_residues[2][WMALL_BLOCK_MAX_SIZE]; int lpc_coefs[2][40]; int lpc_order; int lpc_scaling; int lpc_intbits; - int channel_coeffs[2][2048]; + int channel_coeffs[2][WMALL_BLOCK_MAX_SIZE]; } WmallDecodeCtx; @@ -173,7 +173,7 @@ static av_cold int decode_init(AVCodecContext *avctx) WmallDecodeCtx *s = avctx->priv_data; uint8_t *edata_ptr = avctx->extradata; unsigned int channel_mask; - int i, log2_max_num_subframes, num_possible_block_sizes; + int i, bits, log2_max_num_subframes, num_possible_block_sizes; s->avctx = avctx; init_put_bits(&s->pb, s->frame_data, MAX_FRAMESIZE); @@ -212,8 +212,12 @@ static av_cold int decode_init(AVCodecContext *avctx) s->len_prefix = s->decode_flags & 0x40; /* get frame len */ - s->samples_per_frame = 1 << ff_wma_get_frame_len_bits(avctx->sample_rate, - 3, s->decode_flags); + bits = ff_wma_get_frame_len_bits(avctx->sample_rate, 3, s->decode_flags); + if (bits > WMALL_BLOCK_MAX_BITS) { + av_log_missing_feature(avctx, "big-bits block sizes", 1); + return AVERROR_INVALIDDATA; + } + s->samples_per_frame = 1 << bits; /* init previous block len */ for (i = 0; i < avctx->channels; i++) |