From: Laurent Aimar <fenrir@videolan.org>
Date: Wed, 7 Sep 2011 21:12:32 +0000 (+0200)
Subject: Fixed invalid access in wavpack decoder on corrupted extra bits sub-blocks.
X-Git-Tag: v0.8b1~1579
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=beefafda639dd53fc59c21d8a7cf8334da9a1062;p=platform%2Fupstream%2Flibav.git

Fixed invalid access in wavpack decoder on corrupted extra bits sub-blocks.

Signed-off-by: Martin Storsjö <martin@martin.st>
---

diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c
index 22fab38..fccafa8 100644
--- a/libavcodec/wavpack.c
+++ b/libavcodec/wavpack.c
@@ -385,7 +385,7 @@ static inline int wv_get_value_integer(WavpackFrameContext *s, uint32_t *crc, in
     if(s->extra_bits){
         S <<= s->extra_bits;
 
-        if(s->got_extra_bits){
+        if(s->got_extra_bits && get_bits_left(&s->gb_extra_bits) >= s->extra_bits){
             S |= get_bits(&s->gb_extra_bits, s->extra_bits);
             *crc = *crc * 9 + (S&0xffff) * 3 + ((unsigned)S>>16);
         }