diff options
| author | Justin Ruggles <justin.ruggles@gmail.com> | 2014-06-22 13:19:36 -0400 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2014-06-26 12:52:01 +0200 |
| commit | d7dbc687e312a91ef2ccf797d57b95c61d0e8a2f (patch) | |
| tree | 0f62b7fc7eceadd9410bd2d3fabbe4dc4486da7b | |
| parent | 7997acee0542f6e0bb9ea42ff783f80b70878a2f (diff) | |
| download | ffmpeg-d7dbc687e312a91ef2ccf797d57b95c61d0e8a2f.tar.gz | |
Check mp3 header before calling avpriv_mpegaudio_decode_header().
As indicated in the function documentation, the header MUST be
checked prior to calling it because no consistency check is done
there.
CC:libav-stable@libav.org
(cherry picked from commit f2f2e7627f0c878d13275af5d166ec5932665e28)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
| -rw-r--r-- | libavcodec/libmp3lame.c | 8 | ||||
| -rw-r--r-- | libavformat/mp3enc.c | 17 |
2 files changed, 17 insertions, 8 deletions
diff --git a/libavcodec/libmp3lame.c b/libavcodec/libmp3lame.c index 2e501cac0b..5f6704de2b 100644 --- a/libavcodec/libmp3lame.c +++ b/libavcodec/libmp3lame.c @@ -190,6 +190,7 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt, MPADecodeHeader hdr; int len, ret, ch; int lame_result; + uint32_t h; if (frame) { switch (avctx->sample_fmt) { @@ -245,7 +246,12 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt, determine the frame size. */ if (s->buffer_index < 4) return 0; - if (avpriv_mpegaudio_decode_header(&hdr, AV_RB32(s->buffer))) { + h = AV_RB32(s->buffer); + if (ff_mpa_check_header(h) < 0) { + av_log(avctx, AV_LOG_ERROR, "Invalid mp3 header at start of buffer\n"); + return AVERROR_BUG; + } + if (avpriv_mpegaudio_decode_header(&hdr, h)) { av_log(avctx, AV_LOG_ERROR, "free format output not supported\n"); return -1; } diff --git a/libavformat/mp3enc.c b/libavformat/mp3enc.c index e37abf5530..631705c0a5 100644 --- a/libavformat/mp3enc.c +++ b/libavformat/mp3enc.c @@ -251,13 +251,16 @@ static int mp3_write_audio_packet(AVFormatContext *s, AVPacket *pkt) if (mp3->xing_offset && pkt->size >= 4) { MPADecodeHeader c; - - avpriv_mpegaudio_decode_header(&c, AV_RB32(pkt->data)); - - if (!mp3->initial_bitrate) - mp3->initial_bitrate = c.bit_rate; - if ((c.bit_rate == 0) || (mp3->initial_bitrate != c.bit_rate)) - mp3->has_variable_bitrate = 1; + uint32_t h; + + h = AV_RB32(pkt->data); + if (ff_mpa_check_header(h) == 0) { + avpriv_mpegaudio_decode_header(&c, h); + if (!mp3->initial_bitrate) + mp3->initial_bitrate = c.bit_rate; + if ((c.bit_rate == 0) || (mp3->initial_bitrate != c.bit_rate)) + mp3->has_variable_bitrate = 1; + } mp3_xing_add_frame(mp3, pkt); } |