Check for out of bound writes in the QDM2 decoder.
authorLaurent Aimar <fenrir@videolan.org>
Fri, 30 Sep 2011 22:45:05 +0000 (00:45 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 1 Oct 2011 19:03:45 +0000 (21:03 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4a7876c6e4e62e94d51e364ba99aae4da7671238)

libavcodec/qdm2.c

index a6192e9..1665c8d 100644 (file)
@@ -1799,6 +1799,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
 
     avctx->channels = s->nb_channels = s->channels = AV_RB32(extradata);
     extradata += 4;
+    if (s->channels > MPA_MAX_CHANNELS)
+        return AVERROR_INVALIDDATA;
 
     avctx->sample_rate = AV_RB32(extradata);
     extradata += 4;
@@ -1820,6 +1822,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
     // something like max decodable tones
     s->group_order = av_log2(s->group_size) + 1;
     s->frame_size = s->group_size / 16; // 16 iterations per super block
+    if (s->frame_size > FF_ARRAY_ELEMS(s->output_buffer) / 2)
+        return AVERROR_INVALIDDATA;
 
     s->sub_sampling = s->fft_order - 7;
     s->frequency_range = 255 / (1 << (2 - s->sub_sampling));