avcodec/alsdec: Check r to prevent out of array read

No testcase known

Michael Niedermayer committed 10 years ago

Commit c36fc851 parent 1748eb01 file · +5 −0Browse files

Unified · Split

@@ -767,6 +767,11 @@ static int read_var_block_data(ALSDecContext ctx, ALSBlockData bd) · 766 unmodified lines
767	767
768	768	r = get_unary(gb, 0, 4);
769	769	c = get_bits(gb, 2);
	770	+ if (r >= 4) {
	771	+ av_log(avctx, AV_LOG_ERROR, "r overflow\n");
	772	+ return AVERROR_INVALIDDATA;
	773	+ }
	774	+
770	775	bd->ltp_gain[2] = ltp_gain_values[r][c];
771	776
772	777	bd->ltp_gain[3] = decode_rice(gb, 2) << 3;

Keyboard shortcuts