diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-11-03 20:08:07 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-11-11 01:28:05 +0100 |
| commit | beca13a42e9fb5341e8bd6356fd7d9c2d18aac9b (patch) | |
| tree | 6eab71d1935df4011e802d0251ce3bbc7c77aa29 | |
| parent | b16102ab1c336ed3df7e43229aba4c8a9bf8cb75 (diff) | |
| download | ffmpeg-beca13a42e9fb5341e8bd6356fd7d9c2d18aac9b.tar.gz | |
avformat/rpl: check channels
Fixes: 42537199/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5447162658357248
Fixes: runtime error: signed integer overflow: -3330498059201358222 * 4 cannot be represented in type 'int64_t' (aka 'long')
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/rpl.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/rpl.c b/libavformat/rpl.c index 32a762b60a..e971d0588f 100644 --- a/libavformat/rpl.c +++ b/libavformat/rpl.c @@ -205,6 +205,8 @@ static int rpl_read_header(AVFormatContext *s) if (ast->codecpar->sample_rate < 0) return AVERROR_INVALIDDATA; channels = read_line_and_int(pb, &error); // number of audio channels + if (channels <= 0) + return AVERROR_INVALIDDATA; error |= read_line(pb, line, sizeof(line)); ast->codecpar->bits_per_coded_sample = read_int(line, &endptr, &error); // audio bits per sample av_strlcpy(audio_type, endptr, RPL_LINE_LENGTH); |