diff --git a/libavcodec/mlp.h b/libavcodec/mlp.h index 433f95f6eb..910d819cd9 100644 --- a/libavcodec/mlp.h +++ b/libavcodec/mlp.h @@ -26,6 +26,9 @@ #include "avcodec.h" +/** Last possible matrix channel for each codec */ +#define MAX_MATRIX_CHANNEL_MLP 5 +#define MAX_MATRIX_CHANNEL_TRUEHD 7 /** Maximum number of channels that can be decoded. */ #define MAX_CHANNELS 16 diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c index 493296098a..540d2ed833 100644 --- a/libavcodec/mlpdec.c +++ b/libavcodec/mlpdec.c @@ -335,6 +335,9 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp, uint8_t checksum; uint8_t lossless_check; int start_count = get_bits_count(gbp); + const int max_matrix_channel = m->avctx->codec_id == CODEC_ID_MLP + ? MAX_MATRIX_CHANNEL_MLP + : MAX_MATRIX_CHANNEL_TRUEHD; sync_word = get_bits(gbp, 13); s->noise_type = get_bits1(gbp); @@ -352,6 +355,19 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp, s->max_channel = get_bits(gbp, 4); s->max_matrix_channel = get_bits(gbp, 4); + if (s->max_matrix_channel > max_matrix_channel) { + av_log(m->avctx, AV_LOG_ERROR, + "Max matrix channel cannot be greater than %d.\n", + max_matrix_channel); + return -1; + } + + if (s->max_channel != s->max_matrix_channel) { + av_log(m->avctx, AV_LOG_ERROR, + "Max channel must be equal max matrix channel.\n"); + return -1; + } + if (s->min_channel > s->max_channel) { av_log(m->avctx, AV_LOG_ERROR, "Substream min channel cannot be greater than max channel.\n");