Check mp3 header before calling avpriv_mpegaudio_decode_header().
As indicated in the function documentation, the header MUST be
checked prior to calling it because no consistency check is done
there.
CC:libav-stable@libav.org
(cherry picked from commit f2f2e7627f)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
			
			
This commit is contained in:
		
				
					committed by
					
						
						Luca Barbato
					
				
			
			
				
	
			
			
			
						parent
						
							7997acee05
						
					
				
				
					commit
					d7dbc687e3
				
			@@ -190,6 +190,7 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
 | 
			
		||||
    MPADecodeHeader hdr;
 | 
			
		||||
    int len, ret, ch;
 | 
			
		||||
    int lame_result;
 | 
			
		||||
    uint32_t h;
 | 
			
		||||
 | 
			
		||||
    if (frame) {
 | 
			
		||||
        switch (avctx->sample_fmt) {
 | 
			
		||||
@@ -245,7 +246,12 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
 | 
			
		||||
       determine the frame size. */
 | 
			
		||||
    if (s->buffer_index < 4)
 | 
			
		||||
        return 0;
 | 
			
		||||
    if (avpriv_mpegaudio_decode_header(&hdr, AV_RB32(s->buffer))) {
 | 
			
		||||
    h = AV_RB32(s->buffer);
 | 
			
		||||
    if (ff_mpa_check_header(h) < 0) {
 | 
			
		||||
        av_log(avctx, AV_LOG_ERROR, "Invalid mp3 header at start of buffer\n");
 | 
			
		||||
        return AVERROR_BUG;
 | 
			
		||||
    }
 | 
			
		||||
    if (avpriv_mpegaudio_decode_header(&hdr, h)) {
 | 
			
		||||
        av_log(avctx, AV_LOG_ERROR, "free format output not supported\n");
 | 
			
		||||
        return -1;
 | 
			
		||||
    }
 | 
			
		||||
 
 | 
			
		||||
@@ -251,13 +251,16 @@ static int mp3_write_audio_packet(AVFormatContext *s, AVPacket *pkt)
 | 
			
		||||
 | 
			
		||||
    if (mp3->xing_offset && pkt->size >= 4) {
 | 
			
		||||
        MPADecodeHeader c;
 | 
			
		||||
        uint32_t h;
 | 
			
		||||
 | 
			
		||||
        avpriv_mpegaudio_decode_header(&c, AV_RB32(pkt->data));
 | 
			
		||||
 | 
			
		||||
        if (!mp3->initial_bitrate)
 | 
			
		||||
            mp3->initial_bitrate = c.bit_rate;
 | 
			
		||||
        if ((c.bit_rate == 0) || (mp3->initial_bitrate != c.bit_rate))
 | 
			
		||||
            mp3->has_variable_bitrate = 1;
 | 
			
		||||
        h = AV_RB32(pkt->data);
 | 
			
		||||
        if (ff_mpa_check_header(h) == 0) {
 | 
			
		||||
            avpriv_mpegaudio_decode_header(&c, h);
 | 
			
		||||
            if (!mp3->initial_bitrate)
 | 
			
		||||
                mp3->initial_bitrate = c.bit_rate;
 | 
			
		||||
            if ((c.bit_rate == 0) || (mp3->initial_bitrate != c.bit_rate))
 | 
			
		||||
                mp3->has_variable_bitrate = 1;
 | 
			
		||||
        }
 | 
			
		||||
 | 
			
		||||
        mp3_xing_add_frame(mp3, pkt);
 | 
			
		||||
    }
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user