| 1 | Index: mpegaudiodec.c
|
|---|
| 2 | ===================================================================
|
|---|
| 3 | --- mpegaudiodec.c (revision 13)
|
|---|
| 4 | +++ mpegaudiodec.c (working copy)
|
|---|
| 5 | @@ -1650,8 +1650,12 @@
|
|---|
| 6 | if (get_bits_count(&s->gb) >= end_pos)
|
|---|
| 7 | break;
|
|---|
| 8 | if (code_table) {
|
|---|
| 9 | + const HuffTable *h = &mpa_huff_tables[l];
|
|---|
| 10 | + int size = h -> xsize;
|
|---|
| 11 | +
|
|---|
| 12 | + size = size * size;
|
|---|
| 13 | code = get_vlc2(&s->gb, vlc->table, 8, 2);
|
|---|
| 14 | - if (code < 0)
|
|---|
| 15 | + if (code < 0 || code >= size)
|
|---|
| 16 | return -1;
|
|---|
| 17 | y = code_table[code];
|
|---|
| 18 | x = y >> 4;
|
|---|