diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-01-06 22:58:24 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-07 00:26:33 +0100 |
| commit | ed1eb9602c962e2e7c5ef298c2e17c150dc2c912 (patch) | |
| tree | ff10229bf062777ce74c094d51fc393b28d91f8c | |
| parent | 71fe97a60ad7dd6fe15238ca0eee1ed3121b5f80 (diff) | |
| download | ffmpeg-ed1eb9602c962e2e7c5ef298c2e17c150dc2c912.tar.gz | |
avformat/rmdec: check that sub_packet_size fit in the packet for DEINT_ID_GENR
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7fa8c49400d0_3923_audiosig.rm
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/rmdec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index 8feef54f60..b1025a5955 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -270,6 +270,8 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, if (ast->sub_packet_size <= 0 || ast->sub_packet_size > ast->audio_framesize) return AVERROR_INVALIDDATA; + if (ast->audio_framesize % ast->sub_packet_size) + return AVERROR_INVALIDDATA; break; case DEINT_ID_SIPR: case DEINT_ID_INT0: |