shorten: dont leave invalid channel counts in the context.
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 13 Feb 2013 00:03:30 +0000 (01:03 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 13 Feb 2013 00:04:20 +0000 (01:04 +0100)
Fixes freeing invalid addresses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/shorten.c

index 804dac7..3dda56f 100644 (file)
@@ -343,6 +343,7 @@ static int read_header(ShortenContext *s)
     s->channels = get_uint(s, CHANSIZE);
     if (s->channels <= 0 || s->channels > MAX_CHANNELS) {
         av_log(s->avctx, AV_LOG_ERROR, "too many channels: %d\n", s->channels);
+        s->channels = 0;
         return AVERROR_INVALIDDATA;
     }
     s->avctx->channels = s->channels;