vorbisdec: fix heap buffer overflow.
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 2 Aug 2012 10:21:25 +0000 (12:21 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 2 Aug 2012 10:22:19 +0000 (12:22 +0200)
Found-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/vorbisdec.c

index 4ddd978..34ba7ba 100644 (file)
@@ -1411,7 +1411,7 @@ static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
                                 }
 
                             } else if (vr_type == 2) {
-                                unsigned voffs_div = FASTDIV(voffset, ch);
+                                unsigned voffs_div = ch == 1 ? voffset : FASTDIV(voffset, ch);
                                 unsigned voffs_mod = voffset - voffs_div * ch;
 
                                 for (k = 0; k < step; ++k) {