From f929abd0c3643b28a9552512d698cf61ad4d08fa Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 28 Feb 2012 22:53:20 +0100 Subject: [PATCH] adpcm_xa: Check filter validity. Fixes out of global array read. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/adpcm.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index 19289e8021..54c1dc6983 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -277,6 +277,10 @@ static void xa_decode(short *out, const unsigned char *in, shift = 12 - (in[4+i*2] & 15); filter = in[4+i*2] >> 4; + if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table)) { + av_log_ask_for_sample(NULL, "unknown filter %d\n", filter); + filter=0; + } f0 = xa_adpcm_table[filter][0]; f1 = xa_adpcm_table[filter][1]; @@ -304,6 +308,10 @@ static void xa_decode(short *out, const unsigned char *in, shift = 12 - (in[5+i*2] & 15); filter = in[5+i*2] >> 4; + if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table)) { + av_log_ask_for_sample(NULL, "unknown filter %d\n", filter); + filter=0; + } f0 = xa_adpcm_table[filter][0]; f1 = xa_adpcm_table[filter][1];