From 648dc68098a2d484ebf7b4c48baa3d08e34adef0 Mon Sep 17 00:00:00 2001 From: Laurent Aimar Date: Sat, 17 Sep 2011 16:56:33 +0200 Subject: [PATCH] Reject audio tracks with invalid interleaver parameters in RM demuxer. Signed-off-by: Michael Niedermayer (cherry picked from commit 4907f813581acd6cf68f1be9eb163464503e8208) (cherry picked from commit 24e0a9e451e1aae427307a919d78f6790f4e413c) Signed-off-by: Michael Niedermayer --- libavformat/rmdec.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index 5e3b3c760c..65bc79c332 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -154,8 +154,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, ByteIOContext *pb, ast->audio_framesize = st->codec->block_align; st->codec->block_align = coded_framesize; - if(ast->audio_framesize >= UINT_MAX / sub_packet_h){ - av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h too large\n"); + if (ast->audio_framesize <= 0 || sub_packet_h <= 0 || + ast->audio_framesize >= UINT_MAX / sub_packet_h){ + av_log(s, AV_LOG_ERROR, "ast->audio_framesize * sub_packet_h is invalid\n"); return -1; } @@ -185,8 +186,9 @@ static int rm_read_audio_stream_info(AVFormatContext *s, ByteIOContext *pb, ast->audio_framesize = st->codec->block_align; st->codec->block_align = ast->sub_packet_size; - if(ast->audio_framesize >= UINT_MAX / sub_packet_h){ - av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h too large\n"); + if (ast->audio_framesize <= 0 || sub_packet_h <= 0 || + ast->audio_framesize >= UINT_MAX / sub_packet_h){ + av_log(s, AV_LOG_ERROR, "rm->audio_framesize * sub_packet_h is invalid\n"); return -1; }