diff --git a/libavcodec/mlp.h b/libavcodec/mlp.h index 433f95f6eb3a444463a22cb105ca15d484db823f..910d819cd99f068878a125bf96c3b14d8f52dbf2 100644 --- a/libavcodec/mlp.h +++ b/libavcodec/mlp.h @@ -26,6 +26,9 @@ #include "avcodec.h" +/** Last possible matrix channel for each codec */ +#define MAX_MATRIX_CHANNEL_MLP 5 +#define MAX_MATRIX_CHANNEL_TRUEHD 7 /** Maximum number of channels that can be decoded. */ #define MAX_CHANNELS 16 diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c index 493296098ac6fef27b4d413e11fc0604e2a1e7a7..540d2ed8335b6f712c10c674e175a1d8624d860a 100644 --- a/libavcodec/mlpdec.c +++ b/libavcodec/mlpdec.c @@ -335,6 +335,9 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp, uint8_t checksum; uint8_t lossless_check; int start_count = get_bits_count(gbp); + const int max_matrix_channel = m->avctx->codec_id == CODEC_ID_MLP + ? MAX_MATRIX_CHANNEL_MLP + : MAX_MATRIX_CHANNEL_TRUEHD; sync_word = get_bits(gbp, 13); s->noise_type = get_bits1(gbp); @@ -352,6 +355,19 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp, s->max_channel = get_bits(gbp, 4); s->max_matrix_channel = get_bits(gbp, 4); + if (s->max_matrix_channel > max_matrix_channel) { + av_log(m->avctx, AV_LOG_ERROR, + "Max matrix channel cannot be greater than %d.\n", + max_matrix_channel); + return -1; + } + + if (s->max_channel != s->max_matrix_channel) { + av_log(m->avctx, AV_LOG_ERROR, + "Max channel must be equal max matrix channel.\n"); + return -1; + } + if (s->min_channel > s->max_channel) { av_log(m->avctx, AV_LOG_ERROR, "Substream min channel cannot be greater than max channel.\n");