[FFmpeg-cvslog] r18650 - in trunk/libavcodec: mlp.h mlpdec.c

[ramiro]

Author: ramiro
Date: Wed Apr 22 00:32:50 2009
New Revision: 18650

Log:
mlpdec: Validate num_primitive_matrices.

Modified:
   trunk/libavcodec/mlp.h
   trunk/libavcodec/mlpdec.c

Modified: trunk/libavcodec/mlp.h
==============================================================================
--- trunk/libavcodec/mlp.h	Wed Apr 22 00:12:30 2009	(r18649)
+++ trunk/libavcodec/mlp.h	Wed Apr 22 00:32:50 2009	(r18650)
@@ -35,6 +35,8 @@
 /** Maximum number of matrices used in decoding; most streams have one matrix
  *  per output channel, but some rematrix a channel (usually 0) more than once.
  */
+#define MAX_MATRICES_MLP            6
+#define MAX_MATRICES_TRUEHD         8
 #define MAX_MATRICES        15
 
 /** Maximum number of substreams that can be decoded.

Modified: trunk/libavcodec/mlpdec.c
==============================================================================
--- trunk/libavcodec/mlpdec.c	Wed Apr 22 00:12:30 2009	(r18649)
+++ trunk/libavcodec/mlpdec.c	Wed Apr 22 00:32:50 2009	(r18650)
@@ -527,6 +527,9 @@ static int read_matrix_params(MLPDecodeC
 {
     SubStream *s = &m->substream[substr];
     unsigned int mat, ch;
+    const int max_primitive_matrices = m->avctx->codec_id == CODEC_ID_MLP
+                                     ? MAX_MATRICES_MLP
+                                     : MAX_MATRICES_TRUEHD;
 
     if (m->matrix_changed++ > 1) {
         av_log(m->avctx, AV_LOG_ERROR, "Matrices may change only once per access unit.\n");
@@ -535,6 +538,13 @@ static int read_matrix_params(MLPDecodeC
 
     s->num_primitive_matrices = get_bits(gbp, 4);
 
+    if (s->num_primitive_matrices > max_primitive_matrices) {
+        av_log(m->avctx, AV_LOG_ERROR,
+               "Number of primitive matrices cannot be greater than %d.\n",
+               max_primitive_matrices);
+        return -1;
+    }
+
     for (mat = 0; mat < s->num_primitive_matrices; mat++) {
         int frac_bits, max_chan;
         s->matrix_out_ch[mat] = get_bits(gbp, 4);