diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-07 23:12:32 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2011-09-26 19:26:31 +0200 |
| commit | aee461277a54736511fdcb6298f0e7f9d90e0672 (patch) | |
| tree | 6e16eb3eea13f284bd8df5d71d2cc1b67464a545 | |
| parent | a4f2973b2dfb2efe41d4e387eb9be404511da5e0 (diff) | |
| download | ffmpeg-aee461277a54736511fdcb6298f0e7f9d90e0672.tar.gz | |
Fixed invalid access in wavpack decoder on corrupted extra bits sub-blocks.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit beefafda639dd53fc59c21d8a7cf8334da9a1062)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
| -rw-r--r-- | libavcodec/wavpack.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index e4fe217f59..64725c72c0 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -385,7 +385,7 @@ static inline int wv_get_value_integer(WavpackFrameContext *s, uint32_t *crc, in if(s->extra_bits){ S <<= s->extra_bits; - if(s->got_extra_bits){ + if(s->got_extra_bits && get_bits_left(&s->gb_extra_bits) >= s->extra_bits){ S |= get_bits(&s->gb_extra_bits, s->extra_bits); *crc = *crc * 9 + (S&0xffff) * 3 + ((unsigned)S>>16); } |