xenia-project/FFmpeg
1
0
Fork 0
mirror of https://github.com/xenia-project/FFmpeg.git synced 2024-11-28 14:01:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

aacdec: Fix out of array writes (stack).

Browse Source 
This fixes an issue in the code to check the size that will
be written to match the actual code writing. In the long
term it would make sense to change this so the counting and
writing code are the same so they dont need to be kept in sync.

It also increases the array size, which was too small either way
and adds a redudnant saftey check.

This issue does not affect any FFmpeg release as it has been
introduced Jan 31 which is narrowly after our last release.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-03-06 21:21:02 +01:00
parent b521f11349
commit a8d67efa53
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/aacdec.c
View File

@ -200,7 +200,7 @@ static int count_paired_channels(uint8_t (*layout_map)[3], int tags, int pos, in
break;
if (layout_map[i][0] == TYPE_CPE) {
if (sce_parity) {
if (pos == AAC_CHANNEL_FRONT || !first_cpe) {
if (pos == AAC_CHANNEL_FRONT && !first_cpe) {
sce_parity = 0;
} else {
return -1;
@ -223,10 +223,13 @@ static int count_paired_channels(uint8_t (*layout_map)[3], int tags, int pos, in
static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags)
{
int i, n, total_non_cc_elements;
struct elem_to_channel e2c_vec[MAX_ELEM_ID] = {{ 0 }};
struct elem_to_channel e2c_vec[4*MAX_ELEM_ID] = {{ 0 }};
int num_front_channels, num_side_channels, num_back_channels;
uint64_t layout;
if(FF_ARRAY_ELEMS(e2c_vec) < tags)
return 0;
i = 0;
num_front_channels =
count_paired_channels(layout_map, tags, AAC_CHANNEL_FRONT, &i);