Fix additional crashes.
Unified · Split
| @@ -699,6 +699,10 @@ static int decodeAACfile(char *aacfile, char *sndfile, char *adts_fn, int to_std · 698 unmodified lines | ||
| 699 | 699 | /* update buffer indices */ |
| 700 | 700 | advance_buffer(&b, frameInfo.bytesconsumed); |
| 701 | 701 | |
| 702 | + /* check if the inconsistent number of channels */ | |
| 703 | + if (aufile != NULL && frameInfo.channels != aufile->channels) | |
| 704 | + frameInfo.error = 12; | |
| 705 | + | |
| 702 | 706 | if (frameInfo.error > 0) |
| 703 | 707 | { |
| 704 | 708 | faad_fprintf(stderr, "Error: %s\n", |
| @@ -539,37 +539,61 @@ void raw_data_block(NeAACDecStruct *hDecoder, NeAACDecFrameInfo *hInfo, · 538 unmodified lines | ||
| 539 | 539 | break; |
| 540 | 540 | case 3: |
| 541 | 541 | decode_sce_lfe(hDecoder, hInfo, ld, ID_SCE); |
| 542 | + if (hInfo->error > 0) | |
| 543 | + return; | |
| 542 | 544 | decode_cpe(hDecoder, hInfo, ld, ID_CPE); |
| 543 | 545 | if (hInfo->error > 0) |
| 544 | 546 | return; |
| 545 | 547 | break; |
| 546 | 548 | case 4: |
| 547 | 549 | decode_sce_lfe(hDecoder, hInfo, ld, ID_SCE); |
| 550 | + if (hInfo->error > 0) | |
| 551 | + return; | |
| 548 | 552 | decode_cpe(hDecoder, hInfo, ld, ID_CPE); |
| 553 | + if (hInfo->error > 0) | |
| 554 | + return; | |
| 549 | 555 | decode_sce_lfe(hDecoder, hInfo, ld, ID_SCE); |
| 550 | 556 | if (hInfo->error > 0) |
| 551 | 557 | return; |
| 552 | 558 | break; |
| 553 | 559 | case 5: |
| 554 | 560 | decode_sce_lfe(hDecoder, hInfo, ld, ID_SCE); |
| 561 | + if (hInfo->error > 0) | |
| 562 | + return; | |
| 555 | 563 | decode_cpe(hDecoder, hInfo, ld, ID_CPE); |
| 564 | + if (hInfo->error > 0) | |
| 565 | + return; | |
| 556 | 566 | decode_cpe(hDecoder, hInfo, ld, ID_CPE); |
| 557 | 567 | if (hInfo->error > 0) |
| 558 | 568 | return; |
| 559 | 569 | break; |
| 560 | 570 | case 6: |
| 561 | 571 | decode_sce_lfe(hDecoder, hInfo, ld, ID_SCE); |
| 572 | + if (hInfo->error > 0) | |
| 573 | + return; | |
| 562 | 574 | decode_cpe(hDecoder, hInfo, ld, ID_CPE); |
| 575 | + if (hInfo->error > 0) | |
| 576 | + return; | |
| 563 | 577 | decode_cpe(hDecoder, hInfo, ld, ID_CPE); |
| 578 | + if (hInfo->error > 0) | |
| 579 | + return; | |
| 564 | 580 | decode_sce_lfe(hDecoder, hInfo, ld, ID_LFE); |
| 565 | 581 | if (hInfo->error > 0) |
| 566 | 582 | return; |
| 567 | 583 | break; |
| 568 | 584 | case 7: /* 8 channels */ |
| 569 | 585 | decode_sce_lfe(hDecoder, hInfo, ld, ID_SCE); |
| 586 | + if (hInfo->error > 0) | |
| 587 | + return; | |
| 570 | 588 | decode_cpe(hDecoder, hInfo, ld, ID_CPE); |
| 589 | + if (hInfo->error > 0) | |
| 590 | + return; | |
| 571 | 591 | decode_cpe(hDecoder, hInfo, ld, ID_CPE); |
| 592 | + if (hInfo->error > 0) | |
| 593 | + return; | |
| 572 | 594 | decode_cpe(hDecoder, hInfo, ld, ID_CPE); |
| 595 | + if (hInfo->error > 0) | |
| 596 | + return; | |
| 573 | 597 | decode_sce_lfe(hDecoder, hInfo, ld, ID_LFE); |
| 574 | 598 | if (hInfo->error > 0) |
| 575 | 599 | return; |