diff options
| author | Anton Khirnov <anton@khirnov.net> | 2013-03-28 10:33:02 +0100 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-04-24 21:01:14 +0200 |
| commit | 9aa2eee31389696ddd4042b2f967ee02d38caeff (patch) | |
| tree | f3a9b95017adb5bca021a268eb28a97831f94367 | |
| parent | 0f6364b62bb5f10b25d8cef88acbb9df84fd7f48 (diff) | |
| download | ffmpeg-9aa2eee31389696ddd4042b2f967ee02d38caeff.tar.gz | |
xmv: check audio track parameters validity.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d1016dccdcb10486245e5d7c186cc31af54b2a9c)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavformat/xmv.c | 32 |
1 files changed, 22 insertions, 10 deletions
diff --git a/libavformat/xmv.c b/libavformat/xmv.c index ee4aec3c96..8249ce11e3 100644 --- a/libavformat/xmv.c +++ b/libavformat/xmv.c @@ -126,6 +126,16 @@ static int xmv_probe(AVProbeData *p) return 0; } +static int xmv_read_close(AVFormatContext *s) +{ + XMVDemuxContext *xmv = s->priv_data; + + av_free(xmv->audio); + av_free(xmv->audio_tracks); + + return 0; +} + static int xmv_read_header(AVFormatContext *s, AVFormatParameters *ap) { @@ -136,6 +146,7 @@ static int xmv_read_header(AVFormatContext *s, uint32_t file_version; uint32_t this_packet_size; uint16_t audio_track; + int ret; avio_skip(pb, 4); /* Next packet size */ @@ -214,6 +225,13 @@ static int xmv_read_header(AVFormatContext *s, av_log(s, AV_LOG_WARNING, "Unsupported 5.1 ADPCM audio stream " "(0x%04X)\n", track->flags); + if (!track->channels || !track->sample_rate) { + av_log(s, AV_LOG_ERROR, "Invalid parameters for audio track %d.\n", + audio_track); + ret = AVERROR_INVALIDDATA; + goto fail; + } + ast = avformat_new_stream(s, NULL); if (!ast) { ret = AVERROR(ENOMEM); @@ -244,6 +262,10 @@ static int xmv_read_header(AVFormatContext *s, xmv->stream_count = xmv->audio_track_count + 1; return 0; + +fail: + xmv_read_close(s); + return ret; } static void xmv_read_extradata(uint8_t *extradata, AVIOContext *pb) @@ -551,16 +573,6 @@ static int xmv_read_packet(AVFormatContext *s, return 0; } -static int xmv_read_close(AVFormatContext *s) -{ - XMVDemuxContext *xmv = s->priv_data; - - av_free(xmv->audio); - av_free(xmv->audio_tracks); - - return 0; -} - AVInputFormat ff_xmv_demuxer = { .name = "xmv", .long_name = NULL_IF_CONFIG_SMALL("Microsoft XMV"), |