diff options
| author | Daniel Kang <daniel.d.kang@gmail.com> | 2011-01-11 14:08:45 +0000 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@rainbow.studorg.tuwien.ac.at> | 2011-01-11 14:08:45 +0000 |
| commit | e048a9cab10f1d41dca7b1ad9c8ecaceb3424d86 (patch) | |
| tree | edfb2db5ca2ce9a187c621bcea1329205a4a6171 | |
| parent | 440d761e40e05af4eed5fb8ceccbe50382c47465 (diff) | |
| download | ffmpeg-e048a9cab10f1d41dca7b1ad9c8ecaceb3424d86.tar.gz | |
Do not crash for illegal sample size, fixes issue 2502.
Patch by Daniel Kang, daniel.d.kang at gmail
Originally committed as revision 26309 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavcodec/pcm.c | 5 | ||||
| -rw-r--r-- | libavformat/vocdec.c | 18 |
2 files changed, 20 insertions, 3 deletions
diff --git a/libavcodec/pcm.c b/libavcodec/pcm.c index b6b49dc049..533e834a54 100644 --- a/libavcodec/pcm.c +++ b/libavcodec/pcm.c @@ -292,6 +292,11 @@ static int pcm_decode_frame(AVCodecContext *avctx, /* we process 40-bit blocks per channel for LXF */ sample_size = 5; + if (sample_size == 0) { + av_log(avctx, AV_LOG_ERROR, "Invalid sample_size\n"); + return AVERROR(EINVAL); + } + n = avctx->channels * sample_size; if(n && buf_size % n){ diff --git a/libavformat/vocdec.c b/libavformat/vocdec.c index 909520c5e5..aa69dd2fdf 100644 --- a/libavformat/vocdec.c +++ b/libavformat/vocdec.c @@ -68,7 +68,7 @@ voc_get_packet(AVFormatContext *s, AVPacket *pkt, AVStream *st, int max_size) AVCodecContext *dec = st->codec; ByteIOContext *pb = s->pb; VocType type; - int size; + int size, tmp_codec; int sample_rate = 0; int channels = 1; @@ -90,7 +90,11 @@ voc_get_packet(AVFormatContext *s, AVPacket *pkt, AVStream *st, int max_size) if (sample_rate) dec->sample_rate = sample_rate; dec->channels = channels; - dec->codec_id = ff_codec_get_id(ff_voc_codec_tags, get_byte(pb)); + tmp_codec = ff_codec_get_id(ff_voc_codec_tags, get_byte(pb)); + if (dec->codec_id == CODEC_ID_NONE) + dec->codec_id = tmp_codec; + else if (dec->codec_id != tmp_codec) + av_log(s, AV_LOG_WARNING, "Ignoring mid-stream change in audio codec\n"); dec->bits_per_coded_sample = av_get_bits_per_sample(dec->codec_id); voc->remaining_size -= 2; max_size -= 2; @@ -113,7 +117,11 @@ voc_get_packet(AVFormatContext *s, AVPacket *pkt, AVStream *st, int max_size) dec->sample_rate = get_le32(pb); dec->bits_per_coded_sample = get_byte(pb); dec->channels = get_byte(pb); - dec->codec_id = ff_codec_get_id(ff_voc_codec_tags, get_le16(pb)); + tmp_codec = ff_codec_get_id(ff_voc_codec_tags, get_byte(pb)); + if (dec->codec_id == CODEC_ID_NONE) + dec->codec_id = tmp_codec; + else if (dec->codec_id != tmp_codec) + av_log(s, AV_LOG_WARNING, "Ignoring mid-stream change in audio codec\n"); url_fskip(pb, 4); voc->remaining_size -= 12; max_size -= 12; @@ -125,6 +133,10 @@ voc_get_packet(AVFormatContext *s, AVPacket *pkt, AVStream *st, int max_size) voc->remaining_size = 0; break; } + if (dec->codec_id == CODEC_ID_NONE) { + av_log(s, AV_LOG_ERROR, "Invalid codec_id\n"); + if (s->audio_codec_id == CODEC_ID_NONE) return AVERROR(EINVAL); + } } dec->bit_rate = dec->sample_rate * dec->bits_per_coded_sample; |