RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

aacsbr: Check that bs_num_env is valid before writing arrays with it as an offset. 

Originally committed as revision 22413 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Alex Converse 2010-03-09 21:50:10 +00:00
parent 134b8cbb9a
commit 6ebc724060
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libavcodec/aacsbr.c
View File

@ -689,7 +689,6 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
num_rel_lead = get_bits(gb, 2); num_rel_lead = get_bits(gb, 2);
num_rel_trail = get_bits(gb, 2); num_rel_trail = get_bits(gb, 2);
ch_data->bs_num_env = num_rel_lead + num_rel_trail + 1; ch_data->bs_num_env = num_rel_lead + num_rel_trail + 1;
ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
if (ch_data->bs_num_env > 5) { if (ch_data->bs_num_env > 5) {
av_log(ac->avccontext, AV_LOG_ERROR, av_log(ac->avccontext, AV_LOG_ERROR,
@ -698,6 +697,8 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
return -1; return -1;
} }
ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
for (i = 0; i < num_rel_lead; i++) for (i = 0; i < num_rel_lead; i++)
ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2; ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2;
for (i = 0; i < num_rel_trail; i++) for (i = 0; i < num_rel_trail; i++)