vorbisdec: check codebook entry count

Fixes assertion failure

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index f30745d7ae72b7bfacf459440103c30fbf597872..ba5b1a3f94c0a21d0faef0429dc19e496cbc4671 100644 (file)
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -422,6 +422,11 @@ static int vorbis_parse_setup_hdr_codebooks(vorbis_context *vc)
         }
 
 // Initialize VLC table
+        if (entries <= 0) {
+            av_log(vc->avctx, AV_LOG_ERROR, "Invalid codebook entry count\n");
+            ret = AVERROR_INVALIDDATA;
+            goto error;
+        }
         if (ff_vorbis_len2vlc(tmp_vlc_bits, tmp_vlc_codes, entries)) {
             av_log(vc->avctx, AV_LOG_ERROR, " Invalid code lengths while generating vlcs. \n");
             ret = AVERROR_INVALIDDATA;