diff --git a/libavcodec/wavarc.c b/libavcodec/wavarc.c index 8e4c7d17dc..0dc5849679 100644 --- a/libavcodec/wavarc.c +++ b/libavcodec/wavarc.c @@ -218,6 +218,10 @@ static int decode_1dif(AVCodecContext *avctx, continue; case 6: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 5: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) { @@ -314,6 +318,10 @@ static int decode_2slp(AVCodecContext *avctx, continue; case 7: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 6: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) { @@ -586,6 +594,10 @@ static int decode_5elp(AVCodecContext *avctx, continue; case 10: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 9: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) {