diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-17 16:56:33 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-11-06 18:32:11 +0100 |
| commit | 648dc68098a2d484ebf7b4c48baa3d08e34adef0 (patch) | |
| tree | af2394a804fdd1f9316d8f6214d3ed52d75efe13 | |
| parent | 10da0edddcc0b84ab9898a410969c457cd8ce528 (diff) | |
| download | ffmpeg-648dc68098a2d484ebf7b4c48baa3d08e34adef0.tar.gz | |
Reject audio tracks with invalid interleaver parameters in RM demuxer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4907f813581acd6cf68f1be9eb163464503e8208)
(cherry picked from commit 24e0a9e451e1aae427307a919d78f6790f4e413c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/rmdec.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index 5e3b3c760c..65bc79c332 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -154,8 +154,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, ByteIOContext *pb, ast->audio_framesize = st->codec->block_align; st->codec->block_align = coded_framesize; - if(ast->audio_framesize >= UINT_MAX / sub_packet_h){ - av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h too large\n"); + if (ast->audio_framesize <= 0 || sub_packet_h <= 0 || + ast->audio_framesize >= UINT_MAX / sub_packet_h){ + av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h is invalid\n"); return -1; } @@ -185,8 +186,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, ByteIOContext *pb, ast->audio_framesize = st->codec->block_align; st->codec->block_align = ast->sub_packet_size; - if(ast->audio_framesize >= UINT_MAX / sub_packet_h){ - av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h too large\n"); + if (ast->audio_framesize <= 0 || sub_packet_h <= 0 || + ast->audio_framesize >= UINT_MAX / sub_packet_h){ + av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h is invalid\n"); return -1; } |