Commit f929abd0 authored by Michael Niedermayer's avatar Michael Niedermayer

adpcm_xa: Check filter validity.

Fixes out of global array read.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 34210e8d
...@@ -277,6 +277,10 @@ static void xa_decode(short *out, const unsigned char *in, ...@@ -277,6 +277,10 @@ static void xa_decode(short *out, const unsigned char *in,
shift = 12 - (in[4+i*2] & 15); shift = 12 - (in[4+i*2] & 15);
filter = in[4+i*2] >> 4; filter = in[4+i*2] >> 4;
if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table)) {
av_log_ask_for_sample(NULL, "unknown filter %d\n", filter);
filter=0;
}
f0 = xa_adpcm_table[filter][0]; f0 = xa_adpcm_table[filter][0];
f1 = xa_adpcm_table[filter][1]; f1 = xa_adpcm_table[filter][1];
...@@ -304,6 +308,10 @@ static void xa_decode(short *out, const unsigned char *in, ...@@ -304,6 +308,10 @@ static void xa_decode(short *out, const unsigned char *in,
shift = 12 - (in[5+i*2] & 15); shift = 12 - (in[5+i*2] & 15);
filter = in[5+i*2] >> 4; filter = in[5+i*2] >> 4;
if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table)) {
av_log_ask_for_sample(NULL, "unknown filter %d\n", filter);
filter=0;
}
f0 = xa_adpcm_table[filter][0]; f0 = xa_adpcm_table[filter][0];
f1 = xa_adpcm_table[filter][1]; f1 = xa_adpcm_table[filter][1];
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment