diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-07-08 04:23:45 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-07-08 12:06:17 +0200 |
| commit | e83ffb48aca607ae3ec057f81c3d2eff9c075782 (patch) | |
| tree | 0cea42165896777e2f8082e87d4cc85431211647 | |
| parent | 656e9a68c43cc2adb761758899147af63729535f (diff) | |
| download | ffmpeg-e83ffb48aca607ae3ec057f81c3d2eff9c075782.tar.gz | |
avcodec/utils: Check values in apply_param_change()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/utils.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/libavcodec/utils.c b/libavcodec/utils.c index b80b4e781f..96f177d870 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -2257,6 +2257,7 @@ static int apply_param_change(AVCodecContext *avctx, AVPacket *avpkt) int size = 0, ret; const uint8_t *data; uint32_t flags; + int64_t val; data = av_packet_get_side_data(avpkt, AV_PKT_DATA_PARAM_CHANGE, &size); if (!data) @@ -2277,7 +2278,12 @@ static int apply_param_change(AVCodecContext *avctx, AVPacket *avpkt) if (flags & AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_COUNT) { if (size < 4) goto fail; - avctx->channels = bytestream_get_le32(&data); + val = bytestream_get_le32(&data); + if (val <= 0 || val > INT_MAX) { + av_log(avctx, AV_LOG_ERROR, "Invalid channel count"); + return AVERROR_INVALIDDATA; + } + avctx->channels = val; size -= 4; } if (flags & AV_SIDE_DATA_PARAM_CHANGE_CHANNEL_LAYOUT) { @@ -2289,7 +2295,12 @@ static int apply_param_change(AVCodecContext *avctx, AVPacket *avpkt) if (flags & AV_SIDE_DATA_PARAM_CHANGE_SAMPLE_RATE) { if (size < 4) goto fail; - avctx->sample_rate = bytestream_get_le32(&data); + val = bytestream_get_le32(&data); + if (val <= 0 || val > INT_MAX) { + av_log(avctx, AV_LOG_ERROR, "Invalid sample rate"); + return AVERROR_INVALIDDATA; + } + avctx->sample_rate = val; size -= 4; } if (flags & AV_SIDE_DATA_PARAM_CHANGE_DIMENSIONS) { |