From 357c52d2dff3bf51f2d91ab6ad08f97be4d017b6 Mon Sep 17 00:00:00 2001 From: ramiro Date: Wed, 6 May 2009 16:01:28 +0000 Subject: [PATCH] mlpdec: Fix possible writing out of array bounds introduced by being under-paranoid in r18651. git-svn-id: file:///var/local/repositories/ffmpeg/trunk@18763 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b --- libavcodec/mlpdec.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c index f1a3b3a34..0a64d7989 100644 --- a/libavcodec/mlpdec.c +++ b/libavcodec/mlpdec.c @@ -377,6 +377,15 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp, return -1; } + /* This should happen for TrueHD streams with >6 channels and MLP's noise + * type. It is not yet known if this is allowed. */ + if (s->max_channel > MAX_MATRIX_CHANNEL_MLP && !s->noise_type) { + av_log(m->avctx, AV_LOG_ERROR, + "Number of channels %d is larger than the maximum supported " + "by the decoder. %s\n", s->max_channel+2, sample_message); + return -1; + } + if (s->min_channel > s->max_channel) { av_log(m->avctx, AV_LOG_ERROR, "Substream min channel cannot be greater than max channel.\n"); -- 2.39.2