diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-09-18 11:24:27 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-09-18 11:24:27 +0200 |
| commit | 46cc498b77bcb058823687fc98fa6beb290324c0 (patch) | |
| tree | dbcfd252d771dd9a2e812f3e3131089bb61c3937 /libavformat/xmv.c | |
| parent | c1840cbdbe8c2b91ef0f7b7c50217ca9e4f6ac1a (diff) | |
| parent | d4c2a3740fb95f952a87ba320d2bf31f126bdf68 (diff) | |
| download | ffmpeg-46cc498b77bcb058823687fc98fa6beb290324c0.tar.gz | |
Merge commit 'd4c2a3740fb95f952a87ba320d2bf31f126bdf68'
* commit 'd4c2a3740fb95f952a87ba320d2bf31f126bdf68':
xmv: Add more sanity checks for parameters read from the bitstream
Conflicts:
libavformat/xmv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/xmv.c')
| -rw-r--r-- | libavformat/xmv.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavformat/xmv.c b/libavformat/xmv.c index 672b6d998f..b42b0b1968 100644 --- a/libavformat/xmv.c +++ b/libavformat/xmv.c @@ -49,6 +49,8 @@ XMV_AUDIO_ADPCM51_FRONTCENTERLOW | \ XMV_AUDIO_ADPCM51_REARLEFTRIGHT) +#define XMV_BLOCK_ALIGN_SIZE 36 + /** A video packet with an XMV file. */ typedef struct XMVVideoPacket { int stream_index; ///< The decoder stream index for this video packet. @@ -199,7 +201,7 @@ static int xmv_read_header(AVFormatContext *s) packet->bit_rate = packet->bits_per_sample * packet->sample_rate * packet->channels; - packet->block_align = 36 * packet->channels; + packet->block_align = XMV_BLOCK_ALIGN_SIZE * packet->channels; packet->block_samples = 64; packet->codec_id = ff_wav_codec_get_id(packet->compression, packet->bits_per_sample); @@ -215,7 +217,8 @@ static int xmv_read_header(AVFormatContext *s) av_log(s, AV_LOG_WARNING, "Unsupported 5.1 ADPCM audio stream " "(0x%04X)\n", packet->flags); - if (!packet->channels || !packet->sample_rate) { + if (!packet->channels || !packet->sample_rate || + packet->channels >= UINT16_MAX / XMV_BLOCK_ALIGN_SIZE) { av_log(s, AV_LOG_ERROR, "Invalid parameters for audio track %d.\n", audio_track); ret = AVERROR_INVALIDDATA; |