Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 291d74a46d32183653db07818c7b3407fd50a288)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
... | ... |
@@ -76,6 +76,7 @@ do { \ |
76 | 76 |
#define SAMPLES_NEEDED_2(why) \ |
77 | 77 |
av_log (NULL,AV_LOG_INFO,"This file triggers some missing code. Please contact the developers.\nPosition: %s\n",why); |
78 | 78 |
|
79 |
+#define QDM2_MAX_FRAME_SIZE 512 |
|
79 | 80 |
|
80 | 81 |
typedef int8_t sb_int8_array[2][30][64]; |
81 | 82 |
|
... | ... |
@@ -168,7 +169,7 @@ typedef struct { |
168 | 168 |
/// I/O data |
169 | 169 |
const uint8_t *compressed_data; |
170 | 170 |
int compressed_size; |
171 |
- float output_buffer[1024]; |
|
171 |
+ float output_buffer[QDM2_MAX_FRAME_SIZE * 2]; |
|
172 | 172 |
|
173 | 173 |
/// Synthesis filter |
174 | 174 |
MPADSPContext mpadsp; |
... | ... |
@@ -1797,6 +1798,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx) |
1797 | 1797 |
|
1798 | 1798 |
avctx->channels = s->nb_channels = s->channels = AV_RB32(extradata); |
1799 | 1799 |
extradata += 4; |
1800 |
+ if (s->channels > MPA_MAX_CHANNELS) |
|
1801 |
+ return AVERROR_INVALIDDATA; |
|
1800 | 1802 |
|
1801 | 1803 |
avctx->sample_rate = AV_RB32(extradata); |
1802 | 1804 |
extradata += 4; |
... | ... |
@@ -1818,6 +1821,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx) |
1818 | 1818 |
// something like max decodable tones |
1819 | 1819 |
s->group_order = av_log2(s->group_size) + 1; |
1820 | 1820 |
s->frame_size = s->group_size / 16; // 16 iterations per super block |
1821 |
+ if (s->frame_size > QDM2_MAX_FRAME_SIZE) |
|
1822 |
+ return AVERROR_INVALIDDATA; |
|
1821 | 1823 |
|
1822 | 1824 |
s->sub_sampling = s->fft_order - 7; |
1823 | 1825 |
s->frequency_range = 255 / (1 << (2 - s->sub_sampling)); |