alac: Check channel indexes more completely, fix out of array accesses.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-11-10 18:21:50 +01:00
parent 3920d13878
commit b53f89710b

View File

@ -495,7 +495,9 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data,
}
channels = (element == TYPE_CPE) ? 2 : 1;
if (ch + channels > alac->channels) {
if ( ch + channels > alac->channels
|| alac_channel_layout_offsets[alac->channels - 1][ch] + channels > alac->channels
) {
av_log(avctx, AV_LOG_ERROR, "invalid element channel count\n");
return AVERROR_INVALIDDATA;
}