avcodec/aacdec_template: Check id_map
authorMichael Niedermayer <michael@niedermayer.cc>
Sun, 10 Jan 2016 18:29:39 +0000 (19:29 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Fri, 15 Jan 2016 15:00:31 +0000 (16:00 +0100)
Fixes index out of bounds error
Fixes: aac_index_out_of_bounds.wmv

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 590863876d1478547640304a31c15809c3618090)

Conflicts:

libavcodec/aacdec_template.c

libavcodec/aacdec.c

index 9fe1133..8030827 100644 (file)
@@ -473,6 +473,10 @@ static int output_configure(AACContext *ac,
         int type =         layout_map[i][0];
         int id =           layout_map[i][1];
         id_map[type][id] = type_counts[type]++;
         int type =         layout_map[i][0];
         int id =           layout_map[i][1];
         id_map[type][id] = type_counts[type]++;
+        if (id_map[type][id] >= MAX_ELEM_ID) {
+            avpriv_request_sample(ac->avctx, "Remapped id too large\n");
+            return AVERROR_PATCHWELCOME;
+        }
     }
     // Try to sniff a reasonable channel order, otherwise output the
     // channels in the order the PCE declared them.
     }
     // Try to sniff a reasonable channel order, otherwise output the
     // channels in the order the PCE declared them.