diff options
| author | Reinhard Tartler <siretart@tauware.de> | 2013-05-07 07:13:50 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-05-09 20:05:53 +0200 |
| commit | ade4f3e74635d1fa4b3c34c3a1724b43d92b08b5 (patch) | |
| tree | 9843477d32de32a9002378eec867001cc3fe5abc | |
| parent | 053c19cd88b64a7e66231a41a4d81898aef1b6dd (diff) | |
| download | ffmpeg-ade4f3e74635d1fa4b3c34c3a1724b43d92b08b5.tar.gz | |
aac: check the maximum number of channels
Broken bitstreams could report a larger than specified number of
channels and cause outbound writes.
CC:libav-stable@libav.org
(cherry picked from commit a943a132f36f4df8fe2f749744677b71984abce7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/aacdec.c
| -rw-r--r-- | libavcodec/aacdec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index d479c947a9..b9c8c072c7 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -183,6 +183,8 @@ static av_cold int che_configure(AACContext *ac, enum ChannelPosition che_pos[4][MAX_ELEM_ID], int type, int id, int *channels) { + if (*channels >= MAX_CHANNELS) + return AVERROR_INVALIDDATA; if (che_pos[type][id]) { if (!ac->che[type][id] && !(ac->che[type][id] = av_mallocz(sizeof(ChannelElement)))) return AVERROR(ENOMEM); |