virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

boadec: prevent overflow during block alignment calculation

Browse Source 
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2017-01-26 01:19:02 +01:00
parent 169c1cfa92
commit 9ec8790ac4
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavformat/boadec.c
View File

@ -20,6 +20,7 @@
*/
#include "libavutil/intreadwrite.h"
#include "libavcodec/internal.h"
#include "avformat.h"
#include "internal.h"
@ -53,9 +54,20 @@ static int read_header(AVFormatContext *s)
avio_rl32(s->pb);
st->codecpar->sample_rate = avio_rl32(s->pb);
st->codecpar->channels = avio_rl32(s->pb);
if (st->codecpar->channels > FF_SANE_NB_CHANNELS) {
av_log(s, AV_LOG_ERROR, "Too many channels %d > %d\n",
st->codecpar->channels, FF_SANE_NB_CHANNELS);
return AVERROR(ENOSYS);
}
s->internal->data_offset = avio_rl32(s->pb);
avio_r8(s->pb);
st->codecpar->block_align = st->codecpar->channels * avio_rl32(s->pb);
st->codecpar->block_align = avio_rl32(s->pb);
if (st->codecpar->block_align > INT_MAX / FF_SANE_NB_CHANNELS) {
av_log(s, AV_LOG_ERROR, "Too large block alignment %d > %d\n",
st->codecpar->block_align, INT_MAX / FF_SANE_NB_CHANNELS);
return AVERROR_INVALIDDATA;
}
st->codecpar->block_align *= st->codecpar->channels;
avio_seek(s->pb, s->internal->data_offset, SEEK_SET);