diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-17 16:56:33 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-09-21 19:50:13 +0200 |
| commit | 24e0a9e451e1aae427307a919d78f6790f4e413c (patch) | |
| tree | 1dba481a11fb9c5e08dbe07c4242c569e9ad62e7 | |
| parent | 4d8330d09565956ac40036e7b4af58d2d775d03e (diff) | |
| download | ffmpeg-24e0a9e451e1aae427307a919d78f6790f4e413c.tar.gz | |
Reject audio tracks with invalid interleaver parameters in RM demuxer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4907f813581acd6cf68f1be9eb163464503e8208)
| -rw-r--r-- | libavformat/rmdec.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index b7c57af93a..cacca9bc89 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -192,8 +192,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, ast->audio_framesize = st->codec->block_align; st->codec->block_align = coded_framesize; - if(ast->audio_framesize >= UINT_MAX / sub_packet_h){ - av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h too large\n"); + if (ast->audio_framesize <= 0 || sub_packet_h <= 0 || + ast->audio_framesize >= UINT_MAX / sub_packet_h){ + av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h is invalid\n"); return -1; } @@ -229,8 +230,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, if ((ret = rm_read_extradata(pb, st->codec, codecdata_length)) < 0) return ret; - if(ast->audio_framesize >= UINT_MAX / sub_packet_h){ - av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h too large\n"); + if (ast->audio_framesize <= 0 || sub_packet_h <= 0 || + ast->audio_framesize >= UINT_MAX / sub_packet_h){ + av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h is invalid\n"); return -1; } |