diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-14 20:49:25 +0200 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-10 02:13:11 +0200 |
commit | c532c56e7b77ee30b86d218d6407d17575fc66a0 (patch) | |
tree | f96130b5b37e5241326f1a29f600525ef4955a1e | |
parent | 36bc9519b6a62456129d1fed92e93e8fd3330933 (diff) | |
download | ffmpeg-c532c56e7b77ee30b86d218d6407d17575fc66a0.tar.gz |
avcodec/dcadec: Check nchans
Fixes CID1239110
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a6a45774d045007f8262cd7c614804390e53122e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r-- | libavcodec/dcadec.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c index aa583742f5..d4c8676686 100644 --- a/libavcodec/dcadec.c +++ b/libavcodec/dcadec.c @@ -571,6 +571,14 @@ static int dca_parse_audio_coding_header(DCAContext *s, int base_channel, } nchans = get_bits(&s->gb, 3) + 1; + if (xxch && nchans >= 3) { + av_log(s->avctx, AV_LOG_ERROR, "nchans %d is too large\n", nchans); + return AVERROR_INVALIDDATA; + } else if (nchans + base_channel > DCA_PRIM_CHANNELS_MAX) { + av_log(s->avctx, AV_LOG_ERROR, "channel sum %d + %d is too large\n", nchans, base_channel); + return AVERROR_INVALIDDATA; + } + s->total_channels = nchans + base_channel; s->prim_channels = s->total_channels; |