wavpack: Properly check channel index, dont write out of arrays
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 28 May 2013 08:56:25 +0000 (10:56 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 28 May 2013 09:02:37 +0000 (11:02 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/wavpack.c

index cf1bccf..a6ce0f4 100644 (file)
@@ -788,11 +788,6 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
         return AVERROR_INVALIDDATA;
     }
 
-    if (wc->ch_offset >= avctx->channels) {
-        av_log(avctx, AV_LOG_ERROR, "too many channels\n");
-        return -1;
-    }
-
     memset(s->decorr, 0, MAX_TERMS * sizeof(Decorr));
     memset(s->ch, 0, sizeof(s->ch));
     s->extra_bits     = 0;
@@ -829,6 +824,11 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
     s->hybrid_minclip = ((-1LL << (orig_bpp - 1)));
     s->CRC            = bytestream2_get_le32(&gb);
 
+    if (wc->ch_offset + s->stereo >= avctx->channels) {
+        av_log(avctx, AV_LOG_ERROR, "too many channels\n");
+        return -1;
+    }
+
     samples_l = data[wc->ch_offset];
     if (s->stereo)
         samples_r = data[wc->ch_offset + 1];