Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: [email protected]
---
libavcodec/shorten.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c
index 1527946..f1a156a 100644
--- a/libavcodec/shorten.c
+++ b/libavcodec/shorten.c
@@ -266,7 +266,8 @@ static void output_buffer(int16_t **samples, int nchan, int
blocksize,
}
}
-static const int fixed_coeffs[3][3] = {
+static const int fixed_coeffs[][3] = {
+ { 0, 0, 0 },
{ 1, 0, 0 },
{ 2, -1, 0 },
{ 3, -3, 1 }
@@ -295,7 +296,12 @@ static int decode_subframe_lpc(ShortenContext *s, int
command, int channel,
} else {
/* fixed LPC coeffs */
pred_order = command;
- coeffs = fixed_coeffs[pred_order - 1];
+ if (pred_order > FF_ARRAY_ELEMS(fixed_coeffs)) {
+ av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\n",
+ pred_order);
+ return AVERROR_INVALIDDATA;
+ }
+ coeffs = fixed_coeffs[pred_order];
qshift = 0;
}
--
1.8.3.2
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
