Commit 125cf771 authored by Ramiro Polla's avatar Ramiro Polla
Browse files

mlpdec: More validation for read_channel_params()

Originally committed as revision 18235 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent 06e34be8
...@@ -561,6 +561,11 @@ static int read_channel_params(MLPDecodeContext *m, unsigned int substr, ...@@ -561,6 +561,11 @@ static int read_channel_params(MLPDecodeContext *m, unsigned int substr,
if (read_filter_params(m, gbp, ch, IIR) < 0) if (read_filter_params(m, gbp, ch, IIR) < 0)
return -1; return -1;
if (fir->order + iir->order > 8) {
av_log(m->avctx, AV_LOG_ERROR, "Total filter orders too high.\n");
return -1;
}
if (fir->order && iir->order && if (fir->order && iir->order &&
fir->shift != iir->shift) { fir->shift != iir->shift) {
av_log(m->avctx, AV_LOG_ERROR, av_log(m->avctx, AV_LOG_ERROR,
...@@ -582,9 +587,12 @@ static int read_channel_params(MLPDecodeContext *m, unsigned int substr, ...@@ -582,9 +587,12 @@ static int read_channel_params(MLPDecodeContext *m, unsigned int substr,
cp->codebook = get_bits(gbp, 2); cp->codebook = get_bits(gbp, 2);
cp->huff_lsbs = get_bits(gbp, 5); cp->huff_lsbs = get_bits(gbp, 5);
cp->sign_huff_offset = calculate_sign_huff(m, substr, ch); if (cp->huff_lsbs > 24) {
av_log(m->avctx, AV_LOG_ERROR, "Invalid huff_lsbs.\n");
return -1;
}
/* TODO: validate */ cp->sign_huff_offset = calculate_sign_huff(m, substr, ch);
return 0; return 0;
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment