Re: [libav-devel] [PATCH 07/10] aacdec: avoid an out-of-bounds write

[Luca Barbato]

On 21/11/14 13:57, Vittorio Giovara wrote:
> Also move the check in the case it is actually used.
> 
> CC: libav-sta...@libav.org
> Bug-Id: CID 1087090
> ---
>  libavcodec/aacdec.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c
> index 6968102..9c0a46d 100644
> --- a/libavcodec/aacdec.c
> +++ b/libavcodec/aacdec.c
> @@ -143,8 +143,6 @@ static av_cold int che_configure(AACContext *ac,
>                                   enum ChannelPosition che_pos,
>                                   int type, int id, int *channels)
>  {
> -    if (*channels >= MAX_CHANNELS)
> -        return AVERROR_INVALIDDATA;
>      if (che_pos) {
>          if (!ac->che[type][id]) {
>              if (!(ac->che[type][id] = av_mallocz(sizeof(ChannelElement))))
> @@ -152,6 +150,8 @@ static av_cold int che_configure(AACContext *ac,
>              ff_aac_sbr_ctx_init(ac, &ac->che[type][id]->sbr);
>          }
>          if (type != TYPE_CCE) {
> +            if (*channels >= MAX_CHANNELS - 2)
> +                return AVERROR_INVALIDDATA;
>              ac->output_element[(*channels)++] = &ac->che[type][id]->ch[0];
>              if (type == TYPE_CPE ||
>                  (type == TYPE_SCE && ac->oc[1].m4ac.ps == 1)) {
> 
Ok.
_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel