Commit 042260cd authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/wavpack: Check L/R values before use to avoid harmless integer...

avcodec/wavpack: Check L/R values before use to avoid harmless integer overflow and undefined behavior in fate
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 52835cb8
...@@ -472,6 +472,14 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb, ...@@ -472,6 +472,14 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
s->decorr[i].samplesB[0] = L; s->decorr[i].samplesB[0] = L;
} }
} }
if (type == AV_SAMPLE_FMT_S16P) {
if (FFABS(L) + FFABS(R) > (1<<19)) {
av_log(s->avctx, AV_LOG_ERROR, "sample %d %d too large\n", L, R);
return AVERROR_INVALIDDATA;
}
}
pos = (pos + 1) & 7; pos = (pos + 1) & 7;
if (s->joint) if (s->joint)
L += (R -= (L >> 1)); L += (R -= (L >> 1));
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment