Fixed invalid access in wavpack decoder on corrupted extra bits sub-blocks.
authorLaurent Aimar <fenrir@videolan.org>
Wed, 7 Sep 2011 21:12:32 +0000 (23:12 +0200)
committerMartin Storsjö <martin@martin.st>
Thu, 8 Sep 2011 08:57:13 +0000 (11:57 +0300)
Signed-off-by: Martin Storsjö <martin@martin.st>
libavcodec/wavpack.c

index 22fab38..fccafa8 100644 (file)
@@ -385,7 +385,7 @@ static inline int wv_get_value_integer(WavpackFrameContext *s, uint32_t *crc, in
     if(s->extra_bits){
         S <<= s->extra_bits;
 
     if(s->extra_bits){
         S <<= s->extra_bits;
 
-        if(s->got_extra_bits){
+        if(s->got_extra_bits && get_bits_left(&s->gb_extra_bits) >= s->extra_bits){
             S |= get_bits(&s->gb_extra_bits, s->extra_bits);
             *crc = *crc * 9 + (S&0xffff) * 3 + ((unsigned)S>>16);
         }
             S |= get_bits(&s->gb_extra_bits, s->extra_bits);
             *crc = *crc * 9 + (S&0xffff) * 3 + ((unsigned)S>>16);
         }