RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

cook: check js_subband_start for validity 

Fixes out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c69315a5de)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-02-20 00:19:39 +01:00
parent 2b6f3be082
commit dfeef3a209
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/cook.c
View File

@ -1086,6 +1086,11 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
if (extradata_size >= 8){
bytestream_get_be32(&edata_ptr); //Unknown unused
q->subpacket[s].js_subband_start = bytestream_get_be16(&edata_ptr);
if (q->subpacket[s].js_subband_start >= 51) {
av_log(avctx, AV_LOG_ERROR, "js_subband_start %d is too large\n", q->subpacket[s].js_subband_start);
return AVERROR_INVALIDDATA;
}
q->subpacket[s].js_vlc_bits = bytestream_get_be16(&edata_ptr);
extradata_size -= 8;
}