lavc/alac: Avoid allocating huge memory blocks for malicious alac input.
authorCarl Eugen Hoyos <ceffmpeg@gmail.com>
Wed, 1 Nov 2017 14:14:22 +0000 (15:14 +0100)
committerCarl Eugen Hoyos <ceffmpeg@gmail.com>
Sat, 4 Nov 2017 16:08:18 +0000 (17:08 +0100)
libavcodec/alac.c

index d6bd21b..93cf198 100644 (file)
@@ -524,7 +524,7 @@ static int alac_set_info(ALACContext *alac)
 
     alac->max_samples_per_frame = bytestream2_get_be32u(&gb);
     if (!alac->max_samples_per_frame ||
-        alac->max_samples_per_frame > INT_MAX / sizeof(int32_t)) {
+        alac->max_samples_per_frame > 4096 * 4096) {
         av_log(alac->avctx, AV_LOG_ERROR,
                "max samples per frame invalid: %"PRIu32"\n",
                alac->max_samples_per_frame);