cook: check subacket count
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 21 Apr 2012 17:28:35 +0000 (19:28 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 21 Apr 2012 17:28:35 +0000 (19:28 +0200)
Fixes out of array writes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/cook.c

index 4dcb525..292148a 100644 (file)
@@ -1238,6 +1238,11 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
         q->subpacket[s].gains2.now      = q->subpacket[s].gain_3;
         q->subpacket[s].gains2.previous = q->subpacket[s].gain_4;
 
+        if (q->num_subpackets + q->subpacket[s].num_channels > q->nb_channels) {
+            av_log(avctx, AV_LOG_ERROR, "Too many subpackets %d for channels %d\n", q->num_subpackets, q->nb_channels);
+            return AVERROR_INVALIDDATA;
+        }
+
         q->num_subpackets++;
         s++;
         if (s > MAX_SUBPACKETS) {