mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2024-12-23 12:43:46 +02:00
alsdec: check block length
Fix writing over the end Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
16c3cb9bbf
commit
0ceca269b6
@ -553,12 +553,15 @@ static void get_block_sizes(ALSDecContext *ctx, unsigned int *div_blocks,
|
|||||||
|
|
||||||
/** Read the block data for a constant block
|
/** Read the block data for a constant block
|
||||||
*/
|
*/
|
||||||
static void read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd)
|
static int read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd)
|
||||||
{
|
{
|
||||||
ALSSpecificConfig *sconf = &ctx->sconf;
|
ALSSpecificConfig *sconf = &ctx->sconf;
|
||||||
AVCodecContext *avctx = ctx->avctx;
|
AVCodecContext *avctx = ctx->avctx;
|
||||||
GetBitContext *gb = &ctx->gb;
|
GetBitContext *gb = &ctx->gb;
|
||||||
|
|
||||||
|
if (bd->block_length <= 0)
|
||||||
|
return -1;
|
||||||
|
|
||||||
*bd->raw_samples = 0;
|
*bd->raw_samples = 0;
|
||||||
*bd->const_block = get_bits1(gb); // 1 = constant value, 0 = zero block (silence)
|
*bd->const_block = get_bits1(gb); // 1 = constant value, 0 = zero block (silence)
|
||||||
bd->js_blocks = get_bits1(gb);
|
bd->js_blocks = get_bits1(gb);
|
||||||
@ -573,6 +576,8 @@ static void read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd)
|
|||||||
|
|
||||||
// ensure constant block decoding by reusing this field
|
// ensure constant block decoding by reusing this field
|
||||||
*bd->const_block = 1;
|
*bd->const_block = 1;
|
||||||
|
|
||||||
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
@ -972,7 +977,8 @@ static int read_block(ALSDecContext *ctx, ALSBlockData *bd)
|
|||||||
if (read_var_block_data(ctx, bd))
|
if (read_var_block_data(ctx, bd))
|
||||||
return -1;
|
return -1;
|
||||||
} else {
|
} else {
|
||||||
read_const_block_data(ctx, bd);
|
if (read_const_block_data(ctx, bd) < 0)
|
||||||
|
return -1;
|
||||||
}
|
}
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
|
Loading…
Reference in New Issue
Block a user