[SCM] libav/experimental: Check masterbook index and subclass book index. 14_floor_masterbook_index.patch by chrome
siretart at users.alioth.debian.org
siretart at users.alioth.debian.org
Sun Jun 30 16:51:45 UTC 2013
The following commit has been merged in the experimental branch:
commit 993092dcd3fb7ec84fdd1cd3b28a3973740b22bf
Author: Google Chrome <>
Date: Wed Sep 23 12:17:54 2009 +0000
Check masterbook index and subclass book index.
14_floor_masterbook_index.patch by chrome
Originally committed as revision 19991 to svn://svn.ffmpeg.org/ffmpeg/trunk
diff --git a/libavcodec/vorbis_dec.c b/libavcodec/vorbis_dec.c
index ec305ba..3daba8f 100644
--- a/libavcodec/vorbis_dec.c
+++ b/libavcodec/vorbis_dec.c
@@ -487,13 +487,23 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc) {
AV_DEBUG(" %d floor %d class dim: %d subclasses %d \n", i, j, floor_setup->data.t1.class_dimensions[j], floor_setup->data.t1.class_subclasses[j]);
if (floor_setup->data.t1.class_subclasses[j]) {
- floor_setup->data.t1.class_masterbook[j]=get_bits(gb, 8);
+ int bits=get_bits(gb, 8);
+ if (bits>=vc->codebook_count) {
+ av_log(vc->avccontext, AV_LOG_ERROR, "Masterbook index %d is out of range.\n", bits);
+ return 1;
+ }
+ floor_setup->data.t1.class_masterbook[j]=bits;
AV_DEBUG(" masterbook: %d \n", floor_setup->data.t1.class_masterbook[j]);
}
for(k=0;k<(1<<floor_setup->data.t1.class_subclasses[j]);++k) {
- floor_setup->data.t1.subclass_books[j][k]=(int16_t)get_bits(gb, 8)-1;
+ int16_t bits=get_bits(gb, 8)-1;
+ if (bits!=-1 && bits>=vc->codebook_count) {
+ av_log(vc->avccontext, AV_LOG_ERROR, "Subclass book index %d is out of range.\n", bits);
+ return 1;
+ }
+ floor_setup->data.t1.subclass_books[j][k]=bits;
AV_DEBUG(" book %d. : %d \n", k, floor_setup->data.t1.subclass_books[j][k]);
}
--
Libav/FFmpeg packaging
More information about the pkg-multimedia-commits
mailing list