[FFmpeg-cvslog] adpcm_xa: Check filter validity.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Tue Feb 28 22:53:20 2012 +0100| [f929abd0c3643b28a9552512d698cf61ad4d08fa] | committer: Michael Niedermayer

adpcm_xa: Check filter validity.

Fixes out of global array read.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f929abd0c3643b28a9552512d698cf61ad4d08fa
---

 libavcodec/adpcm.c |    8 ++++++++
 1 files changed, 8 insertions(+), 0 deletions(-)

diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index 19289e8..54c1dc6 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -277,6 +277,10 @@ static void xa_decode(short *out, const unsigned char *in,
 
         shift  = 12 - (in[4+i*2] & 15);
         filter = in[4+i*2] >> 4;
+        if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table)) {
+            av_log_ask_for_sample(NULL, "unknown filter %d\n", filter);
+            filter=0;
+        }
         f0 = xa_adpcm_table[filter][0];
         f1 = xa_adpcm_table[filter][1];
 
@@ -304,6 +308,10 @@ static void xa_decode(short *out, const unsigned char *in,
 
         shift  = 12 - (in[5+i*2] & 15);
         filter = in[5+i*2] >> 4;
+        if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table)) {
+            av_log_ask_for_sample(NULL, "unknown filter %d\n", filter);
+            filter=0;
+        }
 
         f0 = xa_adpcm_table[filter][0];
         f1 = xa_adpcm_table[filter][1];