rmdec: when using INT4 deinterleaving, error out if sub_packet_h <= 1.
authorRonald S. Bultje <rsbultje@gmail.com>
Tue, 21 Feb 2012 18:36:27 +0000 (10:36 -0800)
committerRonald S. Bultje <rsbultje@gmail.com>
Wed, 22 Feb 2012 17:17:27 +0000 (09:17 -0800)
We read sub_packet_h / 2 packets per line of data (during deinterleaving),
which equals zero if sub_packet_h <= 1, thus causing us to not read any
data, leading to an infinite loop.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
libavformat/rmdec.c

index ee8abdd..ed16b07 100644 (file)
@@ -265,6 +265,7 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
         switch (ast->deint_id) {
         case DEINT_ID_INT4:
             if (ast->coded_framesize > ast->audio_framesize ||
+                sub_packet_h <= 1 ||
                 ast->coded_framesize * sub_packet_h > (2 + (sub_packet_h & 1)) * ast->audio_framesize)
                 return AVERROR_INVALIDDATA;
             break;