generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Check if an mp3 header is using a reserved sample rate.

Browse Source 
Fixes an invalid read past the end of avpriv_mpa_freq_tab.
Fixes divide-by-zero due to sample_rate being set to 0.

Bug-Id: 705

CC:libav-stable@libav.org
This commit is contained in:
Justin Ruggles 2014-06-22 13:11:32 -04:00
parent 463a7cde56
commit 44127546b0
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/mpegaudiodecheader.c
View File

@ -24,6 +24,8 @@
* MPEG Audio header decoder. * MPEG Audio header decoder.
*/ */
#include "libavutil/common.h"
#include "avcodec.h" #include "avcodec.h"
#include "mpegaudio.h" #include "mpegaudio.h"
#include "mpegaudiodata.h" #include "mpegaudiodata.h"
@ -45,6 +47,8 @@ int avpriv_mpegaudio_decode_header(MPADecodeHeader *s, uint32_t header)
s->layer = 4 - ((header >> 17) & 3); s->layer = 4 - ((header >> 17) & 3);
/* extract frequency */ /* extract frequency */
sample_rate_index = (header >> 10) & 3; sample_rate_index = (header >> 10) & 3;
if (sample_rate_index >= FF_ARRAY_ELEMS(avpriv_mpa_freq_tab))
sample_rate_index = 0;
sample_rate = avpriv_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25); sample_rate = avpriv_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25);
sample_rate_index += 3 * (s->lsf + mpeg25); sample_rate_index += 3 * (s->lsf + mpeg25);
s->sample_rate_index = sample_rate_index; s->sample_rate_index = sample_rate_index;