dcadec: check xch_base_channel against channel_order_tab.
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 14 Dec 2012 22:37:14 +0000 (23:37 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 14 Dec 2012 22:37:44 +0000 (23:37 +0100)
Fix null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/dcadec.c

index 59c1e6e..e7ae6e2 100644 (file)
@@ -2247,6 +2247,8 @@ static int dca_decode_frame(AVCodecContext *avctx, void *data,
                 } else {
                     s->channel_order_tab = dca_channel_reorder_nolfe_xch[s->amode];
                 }
+                if (s->channel_order_tab[s->xch_base_channel] < 0)
+                    return AVERROR_INVALIDDATA;
             } else {
                 channels = num_core_channels + !!s->lfe;
                 s->xch_present = 0; /* disable further xch processing */