Fixes a out of array read.
Unified · Split
| @@ -717,15 +717,19 @@ static int dca_subframe_header(DCAContext *s, int base_channel, int block_index) · 716 unmodified lines | ||
| 717 | 717 | |
| 718 | 718 | for (j = base_channel; j < s->prim_channels; j++) { |
| 719 | 719 | const uint32_t *scale_table; |
| 720 | + unsigned int scale_max; | |
| 720 | 721 | int scale_sum; |
| 721 | 722 | |
| 722 | 723 | memset(s->scale_factor[j], 0, |
| 723 | 724 | s->subband_activity[j] * sizeof(s->scale_factor[0][0][0]) * 2); |
| 724 | 725 | |
| 725 | − if (s->scalefactor_huffman[j] == 6) | |
| 726 | + if (s->scalefactor_huffman[j] == 6) { | |
| 726 | 727 | scale_table = scale_factor_quant7; |
| 727 | − else | |
| 728 | + scale_max = 127; | |
| 729 | + } else { | |
| 728 | 730 | scale_table = scale_factor_quant6; |
| 731 | + scale_max = 63; | |
| 732 | + } | |
| 729 | 733 | |
| 730 | 734 | /* When huffman coded, only the difference is encoded */ |
| 731 | 735 | scale_sum = 0; |
| @@ -733,12 +737,20 @@ static int dca_subframe_header(DCAContext *s, int base_channel, int block_index) · 1 unmodified line | ||
| 733 | 737 | for (k = 0; k < s->subband_activity[j]; k++) { |
| 734 | 738 | if (k >= s->vq_start_subband[j] || s->bitalloc[j][k] > 0) { |
| 735 | 739 | scale_sum = get_scale(&s->gb, s->scalefactor_huffman[j], scale_sum); |
| 740 | + if (scale_sum > scale_max) { | |
| 741 | + av_log(s->avctx, AV_LOG_ERROR, "scale_sum out of range\n"); | |
| 742 | + return AVERROR_INVALIDDATA; | |
| 743 | + } | |
| 736 | 744 | s->scale_factor[j][k][0] = scale_table[scale_sum]; |
| 737 | 745 | } |
| 738 | 746 | |
| 739 | 747 | if (k < s->vq_start_subband[j] && s->transition_mode[j][k]) { |
| 740 | 748 | /* Get second scale factor */ |
| 741 | 749 | scale_sum = get_scale(&s->gb, s->scalefactor_huffman[j], scale_sum); |
| 750 | + if (scale_sum > scale_max) { | |
| 751 | + av_log(s->avctx, AV_LOG_ERROR, "scale_sum out of range\n"); | |
| 752 | + return AVERROR_INVALIDDATA; | |
| 753 | + } | |
| 742 | 754 | s->scale_factor[j][k][1] = scale_table[scale_sum]; |
| 743 | 755 | } |
| 744 | 756 | } |