Merge commit '1b4c468477f3b8d372da8ef4e5405539ad9c1501'
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 30 Jun 2015 10:59:16 +0000 (12:59 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 30 Jun 2015 10:59:16 +0000 (12:59 +0200)
* commit '1b4c468477f3b8d372da8ef4e5405539ad9c1501':
  riff: Validate the wav header size before trying to parse it

Conflicts:
libavformat/riffdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavformat/riffdec.c

@@@ -87,32 -79,19 +87,34 @@@ int ff_get_wav_header(AVIOContext *pb, 
  {
      int id;
  
--    if (size < 14)
++    if (size < 14) {
 +        avpriv_request_sample(codec, "wav header size < 14");
+         return AVERROR_INVALIDDATA;
++    }
  
 -    id                 = avio_rl16(pb);
      codec->codec_type  = AVMEDIA_TYPE_AUDIO;
 -    codec->channels    = avio_rl16(pb);
 -    codec->sample_rate = avio_rl32(pb);
 -    codec->bit_rate    = avio_rl32(pb) * 8;
 -    codec->block_align = avio_rl16(pb);
 +    if (!big_endian) {
 +        id                 = avio_rl16(pb);
 +        codec->channels    = avio_rl16(pb);
 +        codec->sample_rate = avio_rl32(pb);
 +        codec->bit_rate    = avio_rl32(pb) * 8;
 +        codec->block_align = avio_rl16(pb);
 +    } else {
 +        id                 = avio_rb16(pb);
 +        codec->channels    = avio_rb16(pb);
 +        codec->sample_rate = avio_rb32(pb);
 +        codec->bit_rate    = avio_rb32(pb) * 8;
 +        codec->block_align = avio_rb16(pb);
 +    }
      if (size == 14) {  /* We're dealing with plain vanilla WAVEFORMAT */
          codec->bits_per_coded_sample = 8;
 -    } else
 -        codec->bits_per_coded_sample = avio_rl16(pb);
 +    } else {
 +        if (!big_endian) {
 +            codec->bits_per_coded_sample = avio_rl16(pb);
 +        } else {
 +            codec->bits_per_coded_sample = avio_rb16(pb);
 +        }
 +    }
      if (id == 0xFFFE) {
          codec->codec_tag = 0;
      } else {