g729dec: check pitch_delay_int.
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 14 Dec 2012 00:12:56 +0000 (01:12 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 14 Dec 2012 00:13:21 +0000 (01:13 +0100)
Fix out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/g729dec.c

index b44120f..db3f013 100644 (file)
@@ -510,6 +510,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr,
 
         /* Round pitch delay to nearest (used everywhere except ff_acelp_interpolate). */
         pitch_delay_int[i]  = (pitch_delay_3x + 1) / 3;
+        if (pitch_delay_int[i] > PITCH_DELAY_MAX) {
+            av_log(avctx, AV_LOG_WARNING, "pitch_delay_int %d is too large\n", pitch_delay_int[i]);
+            pitch_delay_int[i] = PITCH_DELAY_MAX;
+        }
 
         if (frame_erasure) {
             ctx->rand_value = g729_prng(ctx->rand_value);