diff options
| author | Tomas Härdin <tomas.hardin@codemill.se> | 2011-05-17 19:52:36 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-05-17 22:19:58 +0200 |
| commit | 3d922c84622e7bf8603390b154630c3d62b93b12 (patch) | |
| tree | db4a705edd9cda5f73bd68de2fbc671a0a88938b /libavformat/wav.c | |
| parent | cc1ca9e534d540aa698d14763aee2933ca3dca59 (diff) | |
| download | ffmpeg-3d922c84622e7bf8603390b154630c3d62b93b12.tar.gz | |
Make sure neither data_size nor sample_count is negative
Diffstat (limited to 'libavformat/wav.c')
| -rw-r--r-- | libavformat/wav.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavformat/wav.c b/libavformat/wav.c index 1832bc9660..6b1e574a6e 100644 --- a/libavformat/wav.c +++ b/libavformat/wav.c @@ -238,6 +238,12 @@ static int wav_read_header(AVFormatContext *s, avio_rl64(pb); /* RIFF size */ data_size = avio_rl64(pb); sample_count = avio_rl64(pb); + if (data_size < 0 || sample_count < 0) { + av_log(s, AV_LOG_ERROR, "negative data_size and/or sample_count in " + "ds64: data_size = %li, sample_count = %li\n", + data_size, sample_count); + return AVERROR_INVALIDDATA; + } avio_skip(pb, size - 16); /* skip rest of ds64 chunk */ } |