[FFmpeg-cvslog] cook: check subacket count

[Michael Niedermayer]

ffmpeg | branch: release/0.10 | Michael Niedermayer <michaelni at gmx.at> | Sat Apr 21 19:28:35 2012 +0200| [1ca4e70b6c52601e376c672741a960761c0b2516] | committer: Michael Niedermayer

cook: check subacket count

Fixes out of array writes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 5a35bd92ad6b535fd5d3a7513169661de66ec247)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1ca4e70b6c52601e376c672741a960761c0b2516
---

 libavcodec/cook.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/libavcodec/cook.c b/libavcodec/cook.c
index c963ffe..3d6f0de 100644
--- a/libavcodec/cook.c
+++ b/libavcodec/cook.c
@@ -1235,6 +1235,11 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
         q->subpacket[s].gains2.now      = q->subpacket[s].gain_3;
         q->subpacket[s].gains2.previous = q->subpacket[s].gain_4;
 
+        if (q->num_subpackets + q->subpacket[s].num_channels > q->nb_channels) {
+            av_log(avctx, AV_LOG_ERROR, "Too many subpackets %d for channels %d\n", q->num_subpackets, q->nb_channels);
+            return AVERROR_INVALIDDATA;
+        }
+
         q->num_subpackets++;
         s++;
         if (s > MAX_SUBPACKETS) {