aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2017-01-26 01:19:02 +0100
committerAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2017-01-29 01:20:52 +0100
commit9ec8790ac4787d3d514c5fa27b66d581614fd1be (patch)
tree1231237e5f995e36a670a17f670e80b1e7b55754
parent169c1cfa928040b83f2ac8386333ec5e5cff3df7 (diff)
downloadffmpeg-9ec8790ac4787d3d514c5fa27b66d581614fd1be.tar.gz
boadec: prevent overflow during block alignment calculation
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
-rw-r--r--libavformat/boadec.c14
1 files changed, 13 insertions, 1 deletions
diff --git a/libavformat/boadec.c b/libavformat/boadec.c
index ac2a33b3f0..6055effcad 100644
--- a/libavformat/boadec.c
+++ b/libavformat/boadec.c
@@ -20,6 +20,7 @@
*/
#include "libavutil/intreadwrite.h"
+#include "libavcodec/internal.h"
#include "avformat.h"
#include "internal.h"
@@ -53,9 +54,20 @@ static int read_header(AVFormatContext *s)
avio_rl32(s->pb);
st->codecpar->sample_rate = avio_rl32(s->pb);
st->codecpar->channels = avio_rl32(s->pb);
+ if (st->codecpar->channels > FF_SANE_NB_CHANNELS) {
+ av_log(s, AV_LOG_ERROR, "Too many channels %d > %d\n",
+ st->codecpar->channels, FF_SANE_NB_CHANNELS);
+ return AVERROR(ENOSYS);
+ }
s->internal->data_offset = avio_rl32(s->pb);
avio_r8(s->pb);
- st->codecpar->block_align = st->codecpar->channels * avio_rl32(s->pb);
+ st->codecpar->block_align = avio_rl32(s->pb);
+ if (st->codecpar->block_align > INT_MAX / FF_SANE_NB_CHANNELS) {
+ av_log(s, AV_LOG_ERROR, "Too large block alignment %d > %d\n",
+ st->codecpar->block_align, INT_MAX / FF_SANE_NB_CHANNELS);
+ return AVERROR_INVALIDDATA;
+ }
+ st->codecpar->block_align *= st->codecpar->channels;
avio_seek(s->pb, s->internal->data_offset, SEEK_SET);