Reject audio tracks with invalid interleaver parameters in RM demuxer.
authorLaurent Aimar <fenrir@videolan.org>
Sat, 17 Sep 2011 14:56:33 +0000 (16:56 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 17 Sep 2011 16:26:53 +0000 (18:26 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/rmdec.c

index 5e34647..4d1e75a 100644 (file)
@@ -215,8 +215,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
             ast->audio_framesize = st->codec->block_align;
             st->codec->block_align = coded_framesize;
 
-            if(ast->audio_framesize >= UINT_MAX / sub_packet_h){
-                av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h too large\n");
+            if (ast->audio_framesize <= 0 || sub_packet_h <= 0 ||
+                ast->audio_framesize >= UINT_MAX / sub_packet_h){
+                av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h is invalid\n");
                 return -1;
             }
 
@@ -252,8 +253,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
             if ((ret = rm_read_extradata(pb, st->codec, codecdata_length)) < 0)
                 return ret;
 
-            if(ast->audio_framesize >= UINT_MAX / sub_packet_h){
-                av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h too large\n");
+            if (ast->audio_framesize <= 0 || sub_packet_h <= 0 ||
+                ast->audio_framesize >= UINT_MAX / sub_packet_h){
+                av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h is invalid\n");
                 return -1;
             }