cook: check js_subband_start for validity
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 19 Feb 2013 23:19:39 +0000 (00:19 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 19 Feb 2013 23:20:03 +0000 (00:20 +0100)
Fixes out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/cook.c

index 54b576f..7dcf655 100644 (file)
@@ -1091,6 +1091,11 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
         if (extradata_size >= 8) {
             bytestream_get_be32(&edata_ptr);    // Unknown unused
             q->subpacket[s].js_subband_start = bytestream_get_be16(&edata_ptr);
+            if (q->subpacket[s].js_subband_start >= 51) {
+                av_log(avctx, AV_LOG_ERROR, "js_subband_start %d is too large\n", q->subpacket[s].js_subband_start);
+                return AVERROR_INVALIDDATA;
+            }
+
             q->subpacket[s].js_vlc_bits = bytestream_get_be16(&edata_ptr);
             extradata_size -= 8;
         }