From 6ebc7240606e8f1fccd2edbe4ffac150053a16cc Mon Sep 17 00:00:00 2001 From: Alex Converse Date: Tue, 9 Mar 2010 21:50:10 +0000 Subject: aacsbr: Check that bs_num_env is valid before writing arrays with it as an offset. Originally committed as revision 22413 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/aacsbr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'libavcodec/aacsbr.c') diff --git a/libavcodec/aacsbr.c b/libavcodec/aacsbr.c index 59517b1b38..6915152eca 100644 --- a/libavcodec/aacsbr.c +++ b/libavcodec/aacsbr.c @@ -689,7 +689,6 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr, num_rel_lead = get_bits(gb, 2); num_rel_trail = get_bits(gb, 2); ch_data->bs_num_env = num_rel_lead + num_rel_trail + 1; - ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail; if (ch_data->bs_num_env > 5) { av_log(ac->avccontext, AV_LOG_ERROR, @@ -698,6 +697,8 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr, return -1; } + ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail; + for (i = 0; i < num_rel_lead; i++) ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2; for (i = 0; i < num_rel_trail; i++) -- cgit v1.2.3