shorten: Fix out-of-array read
authorTim Walker <tdskywalker@gmail.com>
Wed, 9 Oct 2013 09:47:04 +0000 (11:47 +0200)
committerLuca Barbato <lu_zero@gentoo.org>
Thu, 10 Oct 2013 15:52:14 +0000 (17:52 +0200)
pred_order == FF_ARRAY_ELEMS(fixed_coeffs) is invalid too.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
libavcodec/shorten.c

index 5ca38c6..31251ac 100644 (file)
@@ -303,7 +303,7 @@ static int decode_subframe_lpc(ShortenContext *s, int command, int channel,
     } else {
         /* fixed LPC coeffs */
         pred_order = command;
-        if (pred_order > FF_ARRAY_ELEMS(fixed_coeffs)) {
+        if (pred_order >= FF_ARRAY_ELEMS(fixed_coeffs)) {
             av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\n",
                    pred_order);
             return AVERROR_INVALIDDATA;