wmapro: error out on impossible scale factor offsets
authorLuca Barbato <lu_zero@gentoo.org>
Sat, 29 Jun 2013 00:16:50 +0000 (02:16 +0200)
committerReinhard Tartler <siretart@tauware.de>
Sat, 6 Jul 2013 08:10:17 +0000 (10:10 +0200)
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 02ec656af72030eea4f3d63e30b25625cce6a3df)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
libavcodec/wmaprodec.c

index 1e3d99a..902c4e3 100644 (file)
@@ -435,7 +435,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
             for (x = 0; x < num_possible_block_sizes; x++) {
                 int v = 0;
                 while (s->sfb_offsets[x][v + 1] << x < offset)
-                    ++v;
+                    if (++v >= MAX_BANDS)
+                        return AVERROR_INVALIDDATA;
                 s->sf_offsets[i][x][b] = v;
             }
         }