1. ffmpeg
  2. Commit 057549a9ccc9fd32df71678e6abe69e10668186a
Browse code

avcodec/aacenc: Check both channels for finiteness

Fixes null pointer dereference
Fixes: 10412fc52ecc6eab40ed67f82ca7b372/signal_sigsegv_2618c99_2129_f808373959e46afb165593332799ffbc.aif

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Michael Niedermayer authored on 2016/01/17 02:32:07
Showing 1 changed files
libavcodec/aacenc.c
History View file @ 057549a
... ... 
@@ -607,14 +607,14 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
607 607 
                 s->mdct1024.mdct_calc(&s->mdct1024, sce->lcoeffs, sce->ret_buf);
608 608 
             }
609 609
610 
-            if (!(isfinite(cpe->ch->coeffs[    0]) &&
611 
-                  isfinite(cpe->ch->coeffs[  128]) &&
612 
-                  isfinite(cpe->ch->coeffs[2*128]) &&
613 
-                  isfinite(cpe->ch->coeffs[3*128]) &&
614 
-                  isfinite(cpe->ch->coeffs[4*128]) &&
615 
-                  isfinite(cpe->ch->coeffs[5*128]) &&
616 
-                  isfinite(cpe->ch->coeffs[6*128]) &&
617 
-                  isfinite(cpe->ch->coeffs[7*128]))
610 
+            if (!(isfinite(cpe->ch[ch].coeffs[    0]) &&
611 
+                  isfinite(cpe->ch[ch].coeffs[  128]) &&
612 
+                  isfinite(cpe->ch[ch].coeffs[2*128]) &&
613 
+                  isfinite(cpe->ch[ch].coeffs[3*128]) &&
614 
+                  isfinite(cpe->ch[ch].coeffs[4*128]) &&
615 
+                  isfinite(cpe->ch[ch].coeffs[5*128]) &&
616 
+                  isfinite(cpe->ch[ch].coeffs[6*128]) &&
617 
+                  isfinite(cpe->ch[ch].coeffs[7*128]))
618 618 
             ) {
619 619 
                 av_log(avctx, AV_LOG_ERROR, "Input contains NaN/+-Inf\n");
620 620 
                 return AVERROR(EINVAL);