alac: fix integer overflow leading to subsequent out of array accesses.
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 10 Nov 2012 16:41:56 +0000 (17:41 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 10 Nov 2012 16:42:35 +0000 (17:42 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/alac.c

index f032ceb..46c3a5b 100644 (file)
@@ -542,7 +542,11 @@ static av_cold int alac_decode_close(AVCodecContext *avctx)
 static int allocate_buffers(ALACContext *alac)
 {
     int ch;
-    int buf_size = alac->max_samples_per_frame * sizeof(int32_t);
+    int buf_size;
+
+    if (alac->max_samples_per_frame > INT_MAX / sizeof(int32_t))
+        goto buf_alloc_fail;
+    buf_size = alac->max_samples_per_frame * sizeof(int32_t);
 
     for (ch = 0; ch < FFMIN(alac->channels, 2); ch++) {
         FF_ALLOC_OR_GOTO(alac->avctx, alac->predict_error_buffer[ch],