qdm2: fix out of array read

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago · fe91becc2d
parent 7d74aaf698
commit fe91becc2d
1 changed files with 6 additions and 3 deletions
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@ -884,9 +884,12 @@ static int synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int le
                        break;

                    case 30:
-                        if (BITS_LEFT(length,gb) >= 4)
-                            samples[0] = type30_dequant[qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1)];
-                        else
+                        if (BITS_LEFT(length,gb) >= 4) {
+                            unsigned v = qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1);
+                            if (v >= FF_ARRAY_ELEMS(type30_dequant))
+                                return AVERROR_INVALIDDATA;
+                            samples[0] = type30_dequant[v];
+                        } else
                            samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx);

                        run = 1;