avcodec/dcadec: Check subsubframes

Fixes: CID1239152
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c
index f385db558c6fcc5789a3fa2fb9a4348f11ec27e3..77c3737aa6bb13cd42638cb6a4e86059346278a4 100644 (file)
--- a/libavcodec/dcadec.c
+++ b/libavcodec/dcadec.c
@@ -437,6 +437,10 @@ static int dca_subframe_header(DCAContext *s, int base_channel, int block_index)
 
     if (!base_channel) {
         s->subsubframes[s->current_subframe]    = get_bits(&s->gb, 2) + 1;
+        if (block_index + s->subsubframes[s->current_subframe] > s->sample_blocks/8) {
+            s->subsubframes[s->current_subframe] = 1;
+            return AVERROR_INVALIDDATA;
+        }
         s->partial_samples[s->current_subframe] = get_bits(&s->gb, 3);
     }