From d629f3edaa39b48ac92ac5e5ae8440e35805b792 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 1 Mar 2012 19:03:41 +0100 Subject: [PATCH] cook: check that category is smaller than 8 This fixes some out of global array accesses of dither_tab. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Reviewed-by: Benjamin Larsson Signed-off-by: Michael Niedermayer --- libavcodec/cook.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavcodec/cook.c b/libavcodec/cook.c index 6c111de785..294044e7f2 100644 --- a/libavcodec/cook.c +++ b/libavcodec/cook.c @@ -647,7 +647,7 @@ static int mono_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer) int category_index[128]; int quant_index_table[102]; int category[128]; - int ret; + int ret, i; memset(&category, 0, sizeof(category)); memset(&category_index, 0, sizeof(category_index)); @@ -657,6 +657,10 @@ static int mono_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer) q->num_vectors = get_bits(&q->gb, p->log2_numvector_size); categorize(q, p, quant_index_table, category, category_index); expand_category(q, category, category_index); + for (i=0; itotal_subbands; i++) { + if (category[i] > 7) + return AVERROR_INVALIDDATA; + } decode_vectors(q, p, category, quant_index_table, mlt_buffer); return 0;