[FFmpeg-cvslog] r22083 - trunk/libavcodec/dca.c

[fenrir]

Author: fenrir
Date: Fri Feb 26 19:50:01 2010
New Revision: 22083

Log:
Fixed a segfault in the DCA decoder with corrupted streams.

 It happens when the number of channels defined by DCAContext:acmod is lower
than DCAContext:prim_channels. In this case, dca_subsubframe() will call
qmf_32_subbands() using s->channel_order_tab[] entries equal to -1.

Modified:
   trunk/libavcodec/dca.c

Modified: trunk/libavcodec/dca.c
==============================================================================
--- trunk/libavcodec/dca.c	Fri Feb 26 19:12:27 2010	(r22082)
+++ trunk/libavcodec/dca.c	Fri Feb 26 19:50:01 2010	(r22083)
@@ -1244,6 +1244,10 @@ static int dca_decode_frame(AVCodecConte
         } else
             s->channel_order_tab = dca_channel_reorder_nolfe[s->amode];
 
+        if (s->prim_channels > 0 &&
+            s->channel_order_tab[s->prim_channels - 1] < 0)
+            return -1;
+
         if(avctx->request_channels == 2 && s->prim_channels > 2) {
             channels = 2;
             s->output = DCA_STEREO;