diff options
| author | Justin Ruggles <justin.ruggles@gmail.com> | 2011-10-11 13:17:44 -0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-11-04 03:30:44 +0100 |
| commit | 998fc04bcfeeaa2b0885ee84e37bcd345797981a (patch) | |
| tree | 1a01c3376c37c3a17e81780ad560d095c43de10e /libavcodec | |
| parent | 43fa5bf55ed5e1a26fff6d0cd434fb911250ee9a (diff) | |
| download | ffmpeg-998fc04bcfeeaa2b0885ee84e37bcd345797981a.tar.gz | |
apedec: use unsigned int for 'nblocks' and make sure that it's within int range
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/apedec.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index 4c2d238b16..260ef2efa0 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -802,7 +802,7 @@ static int ape_decode_frame(AVCodecContext * avctx, int buf_size = avpkt->size; APEContext *s = avctx->priv_data; int16_t *samples = data; - int nblocks; + uint32_t nblocks; int i, n; int blockstodecode; int bytes_used; @@ -838,9 +838,10 @@ static int ape_decode_frame(AVCodecContext * avctx, s->currentframeblocks = nblocks; buf += 4; - if (s->samples <= 0) { + if (!nblocks || nblocks > INT_MAX) { + av_log(avctx, AV_LOG_ERROR, "Invalid sample count: %u.\n", nblocks); *data_size = 0; - return buf_size; + return AVERROR_INVALIDDATA; } memset(s->decoded0, 0, sizeof(s->decoded0)); |