On Wed, Oct 12, 2011 at 10:49:29PM -0400, Justin Ruggles wrote:
> ---
> libavcodec/mlpdec.c | 9 +++++++--
> 1 files changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
> index c90285a..09e047a 100644
> --- a/libavcodec/mlpdec.c
> +++ b/libavcodec/mlpdec.c
> @@ -909,11 +909,16 @@ static int output_data_internal(MLPDecodeContext *m,
> unsigned int substr,
> int32_t *data_32 = (int32_t*) data;
> int16_t *data_16 = (int16_t*) data;
>
> - if (*data_size < (s->max_channel + 1) * s->blockpos * (is32 ? 4 : 2))
> + if (m->avctx->channels != s->max_matrix_channel + 1) {
> + av_log(m->avctx, AV_LOG_ERROR, "channel count mismatch\n");
> + return AVERROR_INVALIDDATA;
> + }
> +
> + if (*data_size < m->avctx->channels * s->blockpos * (is32 ? 4 : 2))
> return -1;
>
> for (i = 0; i < s->blockpos; i++) {
> - for (out_ch = 0; out_ch <= s->max_matrix_channel; out_ch++) {
> + for (out_ch = 0; out_ch < m->avctx->channels; out_ch++) {
> int mat_ch = s->ch_assign[out_ch];
> int32_t sample = m->sample_buffer[i][mat_ch]
> << s->output_shift[mat_ch];
> --
With the first check the second change is unneeded.
And I should remind that s->ch_assign[] is defined exactly for
s->max_matrix_channel+1, so better leave that loop as is.
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
