From 44127546b0a81dc9dd6190739a62d48f0044c6f3 Mon Sep 17 00:00:00 2001 From: Justin Ruggles Date: Sun, 22 Jun 2014 13:11:32 -0400 Subject: [PATCH] Check if an mp3 header is using a reserved sample rate. Fixes an invalid read past the end of avpriv_mpa_freq_tab. Fixes divide-by-zero due to sample_rate being set to 0. Bug-Id: 705 CC:libav-stable@libav.org --- libavcodec/mpegaudiodecheader.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/mpegaudiodecheader.c b/libavcodec/mpegaudiodecheader.c index 69dda452c3..25e73195b8 100644 --- a/libavcodec/mpegaudiodecheader.c +++ b/libavcodec/mpegaudiodecheader.c @@ -24,6 +24,8 @@ * MPEG Audio header decoder. */ +#include "libavutil/common.h" + #include "avcodec.h" #include "mpegaudio.h" #include "mpegaudiodata.h" @@ -45,6 +47,8 @@ int avpriv_mpegaudio_decode_header(MPADecodeHeader *s, uint32_t header) s->layer = 4 - ((header >> 17) & 3); /* extract frequency */ sample_rate_index = (header >> 10) & 3; + if (sample_rate_index >= FF_ARRAY_ELEMS(avpriv_mpa_freq_tab)) + sample_rate_index = 0; sample_rate = avpriv_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25); sample_rate_index += 3 * (s->lsf + mpeg25); s->sample_rate_index = sample_rate_index;