latmdec: Check AudioSpecificConfig length before decoding extradata.

This is different than a normal get_bits() over read because
decode_audio_specific_config() creates its own GetBitContext.

Fixes Bug 170.
This commit is contained in:
Alex Converse 2012-01-11 14:03:57 -08:00
parent e7d02b04dc
commit b5fc571e4f
1 changed files with 2 additions and 0 deletions

View File

@ -2363,6 +2363,8 @@ static int latm_decode_audio_specific_config(struct LATMContext *latmctx,
"config not byte aligned.\n", 1); "config not byte aligned.\n", 1);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
if (asclen <= 0)
return AVERROR_INVALIDDATA;
bits_consumed = decode_audio_specific_config(NULL, avctx, &m4ac, bits_consumed = decode_audio_specific_config(NULL, avctx, &m4ac,
gb->buffer + (config_start_bit / 8), gb->buffer + (config_start_bit / 8),
asclen, sync_extension); asclen, sync_extension);