[FFmpeg-cvslog] r18649 - in trunk/libavcodec: mlp.h mlpdec.c

[ramiro]

Author: ramiro
Date: Wed Apr 22 00:12:30 2009
New Revision: 18649

Log:
mlpdec: Validate max_channel and max_matrix_channel.

Modified:
   trunk/libavcodec/mlp.h
   trunk/libavcodec/mlpdec.c

Modified: trunk/libavcodec/mlp.h
==============================================================================
--- trunk/libavcodec/mlp.h	Tue Apr 21 23:57:23 2009	(r18648)
+++ trunk/libavcodec/mlp.h	Wed Apr 22 00:12:30 2009	(r18649)
@@ -26,6 +26,9 @@
 
 #include "avcodec.h"
 
+/** Last possible matrix channel for each codec */
+#define MAX_MATRIX_CHANNEL_MLP      5
+#define MAX_MATRIX_CHANNEL_TRUEHD   7
 /** Maximum number of channels that can be decoded. */
 #define MAX_CHANNELS        16
 

Modified: trunk/libavcodec/mlpdec.c
==============================================================================
--- trunk/libavcodec/mlpdec.c	Tue Apr 21 23:57:23 2009	(r18648)
+++ trunk/libavcodec/mlpdec.c	Wed Apr 22 00:12:30 2009	(r18649)
@@ -335,6 +335,9 @@ static int read_restart_header(MLPDecode
     uint8_t checksum;
     uint8_t lossless_check;
     int start_count = get_bits_count(gbp);
+    const int max_matrix_channel = m->avctx->codec_id == CODEC_ID_MLP
+                                 ? MAX_MATRIX_CHANNEL_MLP
+                                 : MAX_MATRIX_CHANNEL_TRUEHD;
 
     sync_word = get_bits(gbp, 13);
     s->noise_type = get_bits1(gbp);
@@ -352,6 +355,19 @@ static int read_restart_header(MLPDecode
     s->max_channel        = get_bits(gbp, 4);
     s->max_matrix_channel = get_bits(gbp, 4);
 
+    if (s->max_matrix_channel > max_matrix_channel) {
+        av_log(m->avctx, AV_LOG_ERROR,
+               "Max matrix channel cannot be greater than %d.\n",
+               max_matrix_channel);
+        return -1;
+    }
+
+    if (s->max_channel != s->max_matrix_channel) {
+        av_log(m->avctx, AV_LOG_ERROR,
+               "Max channel must be equal max matrix channel.\n");
+        return -1;
+    }
+
     if (s->min_channel > s->max_channel) {
         av_log(m->avctx, AV_LOG_ERROR,
                "Substream min channel cannot be greater than max channel.\n");