From 709cae2bcbc0ea2c5d46c932b3d8301cf8f98e6b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 1 Jul 2013 02:09:29 +0200 Subject: vorbisdec: Check VLC tables during use instead of setup Fixes regression and Ticket2720 Signed-off-by: Michael Niedermayer --- libavcodec/vorbisdec.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) (limited to 'libavcodec/vorbisdec.c') diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c index 7a7a6dd871..c5950e66a4 100644 --- a/libavcodec/vorbisdec.c +++ b/libavcodec/vorbisdec.c @@ -422,11 +422,6 @@ static int vorbis_parse_setup_hdr_codebooks(vorbis_context *vc) } // Initialize VLC table - if (entries <= 0) { - av_log(vc->avctx, AV_LOG_ERROR, "Invalid codebook entry count\n"); - ret = AVERROR_INVALIDDATA; - goto error; - } if (ff_vorbis_len2vlc(tmp_vlc_bits, tmp_vlc_codes, entries)) { av_log(vc->avctx, AV_LOG_ERROR, " Invalid code lengths while generating vlcs. \n"); ret = AVERROR_INVALIDDATA; @@ -1235,8 +1230,11 @@ static int vorbis_floor1_decode(vorbis_context *vc, cval = cval >> cbits; if (book > -1) { - floor1_Y[offset+j] = get_vlc2(gb, vc->codebooks[book].vlc.table, - vc->codebooks[book].nb_bits, 3); + int v = get_vlc2(gb, vc->codebooks[book].vlc.table, + vc->codebooks[book].nb_bits, 3); + if (v < 0) + return AVERROR_INVALIDDATA; + floor1_Y[offset+j] = v; } else { floor1_Y[offset+j] = 0; } @@ -1330,6 +1328,9 @@ static av_always_inline int setup_classifs(vorbis_context *vc, av_dlog(NULL, "Classword: %u\n", temp); + if ((int)temp < 0) + return temp; + av_assert0(vr->classifications > 1); //needed for inverse[] if (temp <= 65536) { -- cgit v1.2.3