generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Reject audio tracks with invalid interleaver parameters in RM demuxer.

Browse Source 
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4907f81358)
This commit is contained in:
Laurent Aimar
2011-09-17 16:56:33 +02:00
committed by Michael Niedermayer
parent 4d8330d095
commit 24e0a9e451
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavformat/rmdec.c
View File

@@ -192,8 +192,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
ast->audio_framesize = st->codec->block_align;
st->codec->block_align = coded_framesize;
if(ast->audio_framesize >= UINT_MAX / sub_packet_h){
av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h too large\n");
if (ast->audio_framesize <= 0 || sub_packet_h <= 0 ||
ast->audio_framesize >= UINT_MAX / sub_packet_h){
av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h is invalid\n");
return -1;
}
@@ -229,8 +230,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
if ((ret = rm_read_extradata(pb, st->codec, codecdata_length)) < 0)
return ret;
if(ast->audio_framesize >= UINT_MAX / sub_packet_h){
av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h too large\n");
if (ast->audio_framesize <= 0 || sub_packet_h <= 0 ||
ast->audio_framesize >= UINT_MAX / sub_packet_h){
av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h is invalid\n");
return -1;
}