bink: check quant_index, fix out of array read
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 14 Nov 2012 22:24:05 +0000 (23:24 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 14 Nov 2012 22:54:00 +0000 (23:54 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/bink.c

index 91cd651..bcc6361 100644 (file)
@@ -674,6 +674,10 @@ static int read_dct_coeffs(GetBitContext *gb, int32_t block[64], const uint8_t *
         quant_idx = get_bits(gb, 4);
     } else {
         quant_idx = q;
+        if (quant_idx > 15U) {
+            av_log(0, AV_LOG_ERROR, "quant_index %d out of range\n", quant_idx);
+            return AVERROR_INVALIDDATA;
+        }
     }
 
     quant = quant_matrices[quant_idx];