alsdec: Check k used for rice decoder.
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 7 Apr 2012 15:25:47 +0000 (17:25 +0200)
committerJustin Ruggles <justin.ruggles@gmail.com>
Mon, 17 Sep 2012 18:17:26 +0000 (14:17 -0400)
Values that fail this check will cause failure of decode_rice()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
libavcodec/alsdec.c

index 56d7f2f..ef12253 100644 (file)
@@ -651,6 +651,11 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
         for (k = 1; k < sub_blocks; k++)
             s[k] = s[k - 1] + decode_rice(gb, 0);
     }
+    for (k = 1; k < sub_blocks; k++)
+        if (s[k] > 32) {
+            av_log(avctx, AV_LOG_ERROR, "k invalid for rice code.\n");
+            return AVERROR_INVALIDDATA;
+        }
 
     if (get_bits1(gb))
         *bd->shift_lsbs = get_bits(gb, 4) + 1;