twinvq: validate that channels is not <= 0
authorJustin Ruggles <justin.ruggles@gmail.com>
Tue, 23 Oct 2012 17:15:24 +0000 (13:15 -0400)
committerJustin Ruggles <justin.ruggles@gmail.com>
Thu, 1 Nov 2012 15:29:19 +0000 (11:29 -0400)
This could occur due to integer overflow when reading the channel count from
the extradata.

libavcodec/twinvq.c

index d009196..50ee626 100644 (file)
@@ -1126,7 +1126,7 @@ static av_cold int twin_decode_init(AVCodecContext *avctx)
     default: avctx->sample_rate = isampf * 1000; break;
     }
 
-    if (avctx->channels > CHANNELS_MAX) {
+    if (avctx->channels <= 0 || avctx->channels > CHANNELS_MAX) {
         av_log(avctx, AV_LOG_ERROR, "Unsupported number of channels: %i\n",
                avctx->channels);
         return -1;