From f92d7bdfddfaac04b3bb31f2749d173ca1d8ba6d Mon Sep 17 00:00:00 2001
From: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Date: Mon, 14 Nov 2016 21:41:45 +0100
Subject: [PATCH] libopusdec: default to stereo for invalid number of channels
This fixes an out-of-bounds read if avc->channels is 0.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
---
libavcodec/libopusdec.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/libopusdec.c b/libavcodec/libopusdec.c
index c6e15738808..75eaf9bd48c 100644
--- a/libavcodec/libopusdec.c
+++ b/libavcodec/libopusdec.c
@@ -42,6 +42,12 @@ static av_cold int libopus_decode_init(AVCodecContext *avc)
int ret, channel_map = 0, gain_db = 0, nb_streams, nb_coupled;
uint8_t mapping_arr[8] = { 0, 1 }, *mapping;
+ if (avc->channels <= 0) {
+ av_log(avc, AV_LOG_WARNING,
+ "Invalid number of channels %d, defaulting to stereo\n", avc->channels);
+ avc->channels = 2;
+ }
+
avc->sample_rate = 48000;
avc->sample_fmt = avc->request_sample_fmt == AV_SAMPLE_FMT_FLT ?
AV_SAMPLE_FMT_FLT : AV_SAMPLE_FMT_S16;
--
GitLab