Re: [FFmpeg-devel] [PATCH] ac3: validate end in ff_ac3_bit_alloc_calc_mask

2015-04-16 Thread Andreas Cadhalpun
On 16.04.2015 23:04, Michael Niedermayer wrote: > On Thu, Apr 16, 2015 at 09:25:26PM +0200, Andreas Cadhalpun wrote: >> This fixes an invalid read if end is 0: >> band_end = ff_ac3_bin_to_band_tab[end-1] + 1; >> >> Depending on what is before the array, this can cause stack smashing, >> when

Re: [FFmpeg-devel] [PATCH] ac3: validate end in ff_ac3_bit_alloc_calc_mask

2015-04-16 Thread Michael Niedermayer
On Thu, Apr 16, 2015 at 09:25:26PM +0200, Andreas Cadhalpun wrote: > This fixes an invalid read if end is 0: > band_end = ff_ac3_bin_to_band_tab[end-1] + 1; > > Depending on what is before the array, this can cause stack smashing, > when band_end becomes too large. > > Signed-off-by: Andre