From 12623a8026c1657aedce2ef10d58bffba85dee2d Mon Sep 17 00:00:00 2001
From: Aaron Colwell <acolwell@chromium.org>
Date: Wed, 7 Mar 2012 14:51:00 -0800
Subject: [PATCH] vorbisdec: avoid invalid memory access
This fixes some invalid memory access caused later in the function
by res_chan[] not being set for all channels. This happens when a
channel doesn't appear a submap. This change simply returns a
decoder error when this situation is detected.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
---
libavcodec/vorbisdec.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index 0d491c82dd..4a7d6097b1 100644
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -1581,6 +1581,9 @@ static int vorbis_parse_audio_packet(vorbis_context *vc)
ch_left -= ch;
}
+ if (ch_left > 0)
+ return AVERROR_INVALIDDATA;
+
// Inverse coupling
for (i = mapping->coupling_steps - 1; i >= 0; --i) { //warning: i has to be signed