From 12623a8026c1657aedce2ef10d58bffba85dee2d Mon Sep 17 00:00:00 2001 From: Aaron Colwell Date: Wed, 7 Mar 2012 14:51:00 -0800 Subject: vorbisdec: avoid invalid memory access This fixes some invalid memory access caused later in the function by res_chan[] not being set for all channels. This happens when a channel doesn't appear a submap. This change simply returns a decoder error when this situation is detected. Signed-off-by: Ronald S. Bultje --- libavcodec/vorbisdec.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'libavcodec/vorbisdec.c') diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c index 0d491c82dd..4a7d6097b1 100644 --- a/libavcodec/vorbisdec.c +++ b/libavcodec/vorbisdec.c @@ -1581,6 +1581,9 @@ static int vorbis_parse_audio_packet(vorbis_context *vc) ch_left -= ch; } + if (ch_left > 0) + return AVERROR_INVALIDDATA; + // Inverse coupling for (i = mapping->coupling_steps - 1; i >= 0; --i) { //warning: i has to be signed -- cgit v1.2.3