diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-10-19 23:40:41 +0200 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-11-27 00:38:58 +0100 |
| commit | 45b18fbb9a7729c91d69d6359a782a0135b5f2b8 (patch) | |
| tree | e130cb527903f261ce930c2324407a51a64998b1 | |
| parent | 0496403c08ab35b20490a48aa9e3fdbd4d3bf27d (diff) | |
| download | ffmpeg-45b18fbb9a7729c91d69d6359a782a0135b5f2b8.tar.gz | |
rsd: limit number of channels
Negative values don't make sense and too large values can cause
overflows. For AV_CODEC_ID_ADPCM_THP this leads to a too small extradata
buffer being allocated, causing out-of-bounds writes.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit ee5f0f1d355fa0fd9194ac97a2c8598c93ed328b)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
| -rw-r--r-- | libavformat/rsd.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/rsd.c b/libavformat/rsd.c index dd1f3723d0..c773c0aa9e 100644 --- a/libavformat/rsd.c +++ b/libavformat/rsd.c @@ -84,8 +84,10 @@ static int rsd_read_header(AVFormatContext *s) } codec->channels = avio_rl32(pb); - if (!codec->channels) + if (codec->channels <= 0 || codec->channels > INT_MAX / 36) { + av_log(s, AV_LOG_ERROR, "Invalid number of channels: %d\n", codec->channels); return AVERROR_INVALIDDATA; + } avio_skip(pb, 4); // Bit depth codec->sample_rate = avio_rl32(pb); |