[FFmpeg-cvslog] vorbisdec: avoid invalid memory access

Aaron Colwell git at videolan.org
Fri Mar 9 01:49:26 CET 2012


ffmpeg | branch: master | Aaron Colwell <acolwell at chromium.org> | Wed Mar  7 14:51:00 2012 -0800| [12623a8026c1657aedce2ef10d58bffba85dee2d] | committer: Ronald S. Bultje

vorbisdec: avoid invalid memory access

This fixes some invalid memory access caused later in the function
by res_chan[] not being set for all channels. This happens when a
channel doesn't appear a submap. This change simply returns a
decoder error when this situation is detected.

Signed-off-by: Ronald S. Bultje <rsbultje at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=12623a8026c1657aedce2ef10d58bffba85dee2d
---

 libavcodec/vorbisdec.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index 0d491c8..4a7d609 100644
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -1581,6 +1581,9 @@ static int vorbis_parse_audio_packet(vorbis_context *vc)
         ch_left -= ch;
     }
 
+    if (ch_left > 0)
+        return AVERROR_INVALIDDATA;
+
 // Inverse coupling
 
     for (i = mapping->coupling_steps - 1; i >= 0; --i) { //warning: i has to be signed



More information about the ffmpeg-cvslog mailing list