From e5567f2f6982e765c6d477b2cb6b8f9f6a4d77ab Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 10 Jan 2016 19:29:39 +0100 Subject: [PATCH] avcodec/aacdec_template: Check id_map Fixes index out of bounds error Fixes: aac_index_out_of_bounds.wmv Found-by: Piotr Bandurski Signed-off-by: Michael Niedermayer (cherry picked from commit 590863876d1478547640304a31c15809c3618090) Signed-off-by: Michael Niedermayer --- libavcodec/aacdec_template.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c index fb1ce2cb06..ec8264e5f1 100644 --- a/libavcodec/aacdec_template.c +++ b/libavcodec/aacdec_template.c @@ -449,6 +449,10 @@ static int output_configure(AACContext *ac, int type = layout_map[i][0]; int id = layout_map[i][1]; id_map[type][id] = type_counts[type]++; + if (id_map[type][id] >= MAX_ELEM_ID) { + avpriv_request_sample(ac->avctx, "Remapped id too large\n"); + return AVERROR_PATCHWELCOME; + } } // Try to sniff a reasonable channel order, otherwise output the // channels in the order the PCE declared them.