Browse Source

dcstr: fix division by zero

Also check for possible overflows.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit b0a043f51b)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
tags/n3.0.5
Andreas Cadhalpun 9 years ago
parent
commit
e8ab2bd2ac
1 changed files with 7 additions and 1 deletions
  1. +7
    -1
      libavformat/dcstr.c

+ 7
- 1
libavformat/dcstr.c View File

@@ -33,6 +33,7 @@ static int dcstr_probe(AVProbeData *p)
static int dcstr_read_header(AVFormatContext *s)
{
unsigned codec, align;
int mult;
AVStream *st;

st = avformat_new_stream(s, NULL);
@@ -46,7 +47,12 @@ static int dcstr_read_header(AVFormatContext *s)
align = avio_rl32(s->pb);
avio_skip(s->pb, 4);
st->duration = avio_rl32(s->pb);
st->codec->channels *= avio_rl32(s->pb);
mult = avio_rl32(s->pb);
if (st->codec->channels <= 0 || mult <= 0 || mult > INT_MAX / st->codec->channels) {
av_log(s, AV_LOG_ERROR, "invalid number of channels %d x %d\n", st->codec->channels, mult);
return AVERROR_INVALIDDATA;
}
st->codec->channels *= mult;
if (!align || align > INT_MAX / st->codec->channels)
return AVERROR_INVALIDDATA;
st->codec->block_align = align * st->codec->channels;


Loading…
Cancel
Save