Browse code

latmdec: Check AudioSpecificConfig length before decoding extradata.

This is different than a normal get_bits() over read because
decode_audio_specific_config() creates its own GetBitContext.

Fixes Bug 170.

Alex Converse authored on 2012/01/12 07:03:57
Showing 1 changed files
... ...
@@ -2363,6 +2363,8 @@ static int latm_decode_audio_specific_config(struct LATMContext *latmctx,
2363 2363
                                "config not byte aligned.\n", 1);
2364 2364
         return AVERROR_INVALIDDATA;
2365 2365
     }
2366
+    if (asclen <= 0)
2367
+        return AVERROR_INVALIDDATA;
2366 2368
     bits_consumed = decode_audio_specific_config(NULL, avctx, &m4ac,
2367 2369
                                          gb->buffer + (config_start_bit / 8),
2368 2370
                                          asclen, sync_extension);