[FFmpeg-cvslog] twinvqdec: Check the ibps parameter separately

[Martin Storsjö]

ffmpeg | branch: release/1.1 | Martin Storsjö <martin at martin.st> | Tue Sep 17 19:33:48 2013 +0300| [9b9aee27f4e43b4a6b0884f8a6f49eb0289d7c09] | committer: Luca Barbato

twinvqdec: Check the ibps parameter separately

This is required, since invalid parameters actually could
pass the switch check below.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>
(cherry picked from commit c77d409bf95954aceb762dd800d1ee2868c4b0d4)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9b9aee27f4e43b4a6b0884f8a6f49eb0289d7c09
---

 libavcodec/twinvq.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/twinvq.c b/libavcodec/twinvq.c
index 8989469..f6c897f 100644
--- a/libavcodec/twinvq.c
+++ b/libavcodec/twinvq.c
@@ -1142,6 +1142,10 @@ static av_cold int twin_decode_init(AVCodecContext *avctx)
                                                    AV_CH_LAYOUT_STEREO;
 
     ibps = avctx->bit_rate / (1000 * avctx->channels);
+    if (ibps < 8 || ibps > 48) {
+        av_log(avctx, AV_LOG_ERROR, "Bad bitrate per channel value %d\n", ibps);
+        return AVERROR_INVALIDDATA;
+    }
 
     switch ((isampf << 8) +  ibps) {
     case (8 <<8) +  8: tctx->mtab = &mode_08_08; break;