Validate XXCH downmix channel mapping mask.

Prevents possible NULL pointer dereference due to invalid mask read from the bitstream.
foo86 · Dec 14, 2015 · a4a3e9a · a4a3e9a
1 parent 76f1ca4
commit a4a3e9a
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/libdcadec/core_decoder.c b/libdcadec/core_decoder.c
@@ -310,8 +310,14 @@ static int parse_coding_header(struct core_decoder *core, enum HeaderType header
             }
 
             // Downmix channel mapping mask
-            for (ch = xch_base; ch < core->nchannels; ch++)
-                core->dmix_mask[ch] = bits_get(&core->bits, core->xxch_mask_nbits);
+            for (ch = xch_base; ch < core->nchannels; ch++) {
+                mask = bits_get(&core->bits, core->xxch_mask_nbits);
+                if ((mask & core->xxch_core_mask) != mask) {
+                    core_err("Invalid XXCH downmix channel mapping mask (%#x)", mask);
+                    return -DCADEC_EBADDATA;
+                }
+                core->dmix_mask[ch] = mask;
+            }
 
             // Downmix coefficients
             int *coeff_ptr = core->dmix_coeff;