avcodec/dcadec: Check subsubframes
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 14 May 2015 19:29:19 +0000 (21:29 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 1 Jun 2015 21:25:21 +0000 (23:25 +0200)
Fixes: CID1239152

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a9bf628bfdad142763880a3d1ccb6058040dda57)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/dcadec.c

index 7cdf4b4..a32b17b 100644 (file)
@@ -857,6 +857,10 @@ static int dca_subframe_header(DCAContext *s, int base_channel, int block_index)
 
     if (!base_channel) {
         s->subsubframes[s->current_subframe]    = get_bits(&s->gb, 2) + 1;
+        if (block_index + s->subsubframes[s->current_subframe] > s->sample_blocks/8) {
+            s->subsubframes[s->current_subframe] = 1;
+            return AVERROR_INVALIDDATA;
+        }
         s->partial_samples[s->current_subframe] = get_bits(&s->gb, 3);
     }