[FFmpeg-cvslog] cook: check subacket count

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sat Apr 21 19:28:35 2012 +0200| [5a35bd92ad6b535fd5d3a7513169661de66ec247] | committer: Michael Niedermayer

cook: check subacket count

Fixes out of array writes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5a35bd92ad6b535fd5d3a7513169661de66ec247
---

 libavcodec/cook.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/libavcodec/cook.c b/libavcodec/cook.c
index 4dcb525..292148a 100644
--- a/libavcodec/cook.c
+++ b/libavcodec/cook.c
@@ -1238,6 +1238,11 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
         q->subpacket[s].gains2.now      = q->subpacket[s].gain_3;
         q->subpacket[s].gains2.previous = q->subpacket[s].gain_4;
 
+        if (q->num_subpackets + q->subpacket[s].num_channels > q->nb_channels) {
+            av_log(avctx, AV_LOG_ERROR, "Too many subpackets %d for channels %d\n", q->num_subpackets, q->nb_channels);
+            return AVERROR_INVALIDDATA;
+        }
+
         q->num_subpackets++;
         s++;
         if (s > MAX_SUBPACKETS) {