avdevice/pulse_audio_dec: query actual fragment size

Signed-off-by: Marton Balint <cus@passwd.hu>

1 files changed, 9 insertions, 0 deletions

diff --git a/libavdevice/pulse_audio_dec.c b/libavdevice/pulse_audio_dec.c
index 50a3c971ae..6dea332beb 100644
--- a/libavdevice/pulse_audio_dec.c
+++ b/libavdevice/pulse_audio_dec.c
@@ -149,6 +149,7 @@ static av_cold int pulse_read_header(AVFormatContext *s)
 
     pa_buffer_attr attr = { -1 };
     pa_channel_map cmap;
+    const pa_buffer_attr *queried_attr;
 
     pa_channel_map_init_extend(&cmap, pd->channels, PA_CHANNEL_MAP_WAVEEX);
 
@@ -242,6 +243,14 @@ static av_cold int pulse_read_header(AVFormatContext *s)
         pa_threaded_mainloop_wait(pd->mainloop);
     }
 
+    /* Query actual fragment size */
+    queried_attr = pa_stream_get_buffer_attr(pd->stream);
+    if (!queried_attr || queried_attr->fragsize > INT_MAX/100) {
+        ret = AVERROR_EXTERNAL;
+        goto unlock_and_fail;
+    }
+    pd->fragment_size = queried_attr->fragsize;
+
     pa_threaded_mainloop_unlock(pd->mainloop);
 
     /* take real parameters */