diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-28 23:26:18 +0300 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-10-04 03:52:09 +0200 |
| commit | 04d2f9ace3fb6e880f3488770fc5a39de5b63cbb (patch) | |
| tree | 2293f5b6d16f4a901cb0a46bf8496b6e4bc70ff6 | |
| parent | 78aa2ed620178044a227fbbe48f749c0dc86023f (diff) | |
| download | ffmpeg-04d2f9ace3fb6e880f3488770fc5a39de5b63cbb.tar.gz | |
mvi: Add sanity checking for the audio frame size
This avoids a division by zero.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 28ff439efd2362fb21e1a78610737f2e26a72d8f)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
| -rw-r--r-- | libavformat/mvi.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavformat/mvi.c b/libavformat/mvi.c index 10ec8bbb20..65096f10b4 100644 --- a/libavformat/mvi.c +++ b/libavformat/mvi.c @@ -93,6 +93,12 @@ static int read_header(AVFormatContext *s) mvi->get_int = (vst->codec->width * vst->codec->height < (1 << 16)) ? avio_rl16 : avio_rl24; mvi->audio_frame_size = ((uint64_t)mvi->audio_data_size << MVI_FRAC_BITS) / frames_count; + if (mvi->audio_frame_size <= 1 << MVI_FRAC_BITS - 1) { + av_log(s, AV_LOG_ERROR, "Invalid audio_data_size (%d) or frames_count (%d)\n", + mvi->audio_data_size, frames_count); + return AVERROR_INVALIDDATA; + } + mvi->audio_size_counter = (ast->codec->sample_rate * 830 / mvi->audio_frame_size - 1) * mvi->audio_frame_size; mvi->audio_size_left = mvi->audio_data_size; |