From a0212ecf8452e9861286639543a772dc94f3ad07 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 13 Nov 2012 17:33:03 +0100 Subject: [PATCH] dcadec: check layout & channel count for consistency. Fixes out of array accesses Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/dcadec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c index c21a97b2ec..dabc5a4ee1 100644 --- a/libavcodec/dcadec.c +++ b/libavcodec/dcadec.c @@ -2249,6 +2249,11 @@ static int dca_decode_frame(AVCodecContext *avctx, void *data, s->channel_order_tab[channels - 1 - !!s->lfe] < 0) return AVERROR_INVALIDDATA; + if (av_get_channel_layout_nb_channels(avctx->channel_layout) != channels) { + av_log(avctx, AV_LOG_ERROR, "Number of channels %d mismatches layout %d\n", channels, av_get_channel_layout_nb_channels(avctx->channel_layout)); + return AVERROR_INVALIDDATA; + } + if (avctx->request_channels == 2 && s->prim_channels > 2) { channels = 2; s->output = DCA_STEREO;