diff options
| author | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2011-12-23 11:38:37 +0100 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2011-12-23 11:38:37 +0100 |
| commit | e5de9289232c5b14572fa13e2435f9adb0b0f1ec (patch) | |
| tree | 56807d3001c2ba62a3afc6b286667906017b8879 /libavcodec | |
| parent | f810ab45e3be8af96aa8b07154cca1f45bb3e75a (diff) | |
Fix a possible endless loop when decoding aac.
Fixes ticket #789.
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/aacdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index c9ca0a66a2..8fd7f08c78 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -809,10 +809,10 @@ static int decode_band_types(AACContext *ac, enum BandType band_type[120], av_log(ac->avctx, AV_LOG_ERROR, "invalid band type\n"); return -1; } - while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1) + while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1 && get_bits_left(gb) >= bits) sect_end += sect_len_incr; sect_end += sect_len_incr; - if (get_bits_left(gb) < 0) { + if (get_bits_left(gb) < 0 || sect_len_incr == (1 << bits) - 1) { av_log(ac->avctx, AV_LOG_ERROR, overread_err); return -1; } |