Merge commit '7b03b65bf0d02519c86750d2da33f413e11cf0c6'

* commit '7b03b65bf0d02519c86750d2da33f413e11cf0c6':
  lavf: do basic sanity checking on muxed packets

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 27 insertions, 0 deletions

diff --git a/libavformat/mux.c b/libavformat/mux.c
index 70b60640a1..aebfe2c8f7 100644
--- a/libavformat/mux.c
+++ b/libavformat/mux.c
@@ -557,10 +557,33 @@ static int write_packet(AVFormatContext *s, AVPacket *pkt)
     return ret;
 }
 
+static int check_packet(AVFormatContext *s, AVPacket *pkt)
+{
+    if (!pkt)
+        return 0;
+
+    if (pkt->stream_index < 0 || pkt->stream_index >= s->nb_streams) {
+        av_log(s, AV_LOG_ERROR, "Invalid packet stream index: %d\n",
+               pkt->stream_index);
+        return AVERROR(EINVAL);
+    }
+
+    if (s->streams[pkt->stream_index]->codec->codec_type == AVMEDIA_TYPE_ATTACHMENT) {
+        av_log(s, AV_LOG_ERROR, "Received a packet for an attachment stream.\n");
+        return AVERROR(EINVAL);
+    }
+
+    return 0;
+}
+
 int av_write_frame(AVFormatContext *s, AVPacket *pkt)
 {
     int ret;
 
+    ret = check_packet(s, pkt);
+    if (ret < 0)
+        return ret;
+
     if (!pkt) {
         if (s->oformat->flags & AVFMT_ALLOW_FLUSH) {
             ret = s->oformat->write_packet(s, NULL);
@@ -770,6 +793,10 @@ int av_interleaved_write_frame(AVFormatContext *s, AVPacket *pkt)
 {
     int ret, flush = 0;
 
+    ret = check_packet(s, pkt);
+    if (ret < 0)
+        return ret;
+
     if (pkt) {
         AVStream *st = s->streams[pkt->stream_index];