Browse Source

avformat/rmdec: check that sub_packet_size fit in the packet for DEINT_ID_GENR

Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7fa8c49400d0_3923_audiosig.rm
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
tags/n2.2-rc1
Michael Niedermayer 11 years ago
parent
commit
ed1eb9602c
1 changed files with 2 additions and 0 deletions
  1. +2
    -0
      libavformat/rmdec.c

+ 2
- 0
libavformat/rmdec.c View File

@@ -270,6 +270,8 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb,
if (ast->sub_packet_size <= 0 || if (ast->sub_packet_size <= 0 ||
ast->sub_packet_size > ast->audio_framesize) ast->sub_packet_size > ast->audio_framesize)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if (ast->audio_framesize % ast->sub_packet_size)
return AVERROR_INVALIDDATA;
break; break;
case DEINT_ID_SIPR: case DEINT_ID_SIPR:
case DEINT_ID_INT0: case DEINT_ID_INT0:


Loading…
Cancel
Save