Commit 6e42ccb9 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/aacdec: Fix pulse position checks in decode_pulses()

Fixes out of array read
Fixes: asan_static-oob_1efed25_1887_cov_2013541199_HeyYa_RA10_AAC_192K_30s.rm
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 4d7d9a57
......@@ -1426,12 +1426,12 @@ static int decode_pulses(Pulse *pulse, GetBitContext *gb,
return -1;
pulse->pos[0] = swb_offset[pulse_swb];
pulse->pos[0] += get_bits(gb, 5);
if (pulse->pos[0] > 1023)
if (pulse->pos[0] >= swb_offset[num_swb])
return -1;
pulse->amp[0] = get_bits(gb, 4);
for (i = 1; i < pulse->num_pulse; i++) {
pulse->pos[i] = get_bits(gb, 5) + pulse->pos[i - 1];
if (pulse->pos[i] > 1023)
if (pulse->pos[i] >= swb_offset[num_swb])
return -1;
pulse->amp[i] = get_bits(gb, 4);
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment