cook: check subbands more completely, fix out of array read.
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 17 Nov 2012 02:42:48 +0000 (03:42 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 17 Nov 2012 02:43:17 +0000 (03:43 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/cook.c

index a02dd86..0092f25 100644 (file)
@@ -1197,6 +1197,10 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
             av_log_ask_for_sample(avctx, "subbands > 50\n");
             return AVERROR_PATCHWELCOME;
         }
+        if (q->subpacket[s].subbands == 0) {
+            av_log_ask_for_sample(avctx, "subbands is 0\n");
+            return AVERROR_PATCHWELCOME;
+        }
         q->subpacket[s].gains1.now      = q->subpacket[s].gain_1;
         q->subpacket[s].gains1.previous = q->subpacket[s].gain_2;
         q->subpacket[s].gains2.now      = q->subpacket[s].gain_3;