From 57a138df86d4f026299b9d12aba829b82d67aae6 Mon Sep 17 00:00:00 2001 From: Vincent Penquerc'h Date: Tue, 8 Apr 2014 12:37:30 +0100 Subject: [PATCH] dtsdec: fix buffer overflows Channels can be up to 7. Also add a guard in case more can be returned in the future. Coverity 1139820, 1139821 --- ext/dts/gstdtsdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/dts/gstdtsdec.c b/ext/dts/gstdtsdec.c index d92bf05691..a14d08fae9 100644 --- a/ext/dts/gstdtsdec.c +++ b/ext/dts/gstdtsdec.c @@ -400,12 +400,12 @@ gst_dtsdec_renegotiate (GstDtsDec * dts) { gint channels; gboolean result = FALSE; - GstAudioChannelPosition from[6], to[6]; + GstAudioChannelPosition from[7], to[7]; GstAudioInfo info; channels = gst_dtsdec_channels (dts->using_channels, from); - if (!channels) + if (channels <= 0 || channels > 7) goto done; GST_INFO_OBJECT (dts, "dtsdec renegotiate, channels=%d, rate=%d",