ffmpeg | branch: master | Andreas Cadhalpun <andreas.cadhal...@googlemail.com> | Wed Oct 19 23:40:41 2016 +0200| [ee5f0f1d355fa0fd9194ac97a2c8598c93ed328b] | committer: Andreas Cadhalpun
rsd: limit number of channels Negative values don't make sense and too large values can cause overflows. For AV_CODEC_ID_ADPCM_THP this leads to a too small extradata buffer being allocated, causing out-of-bounds writes. Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc> Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ee5f0f1d355fa0fd9194ac97a2c8598c93ed328b --- libavformat/rsd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/rsd.c b/libavformat/rsd.c index ee6fdfb..5a56e72 100644 --- a/libavformat/rsd.c +++ b/libavformat/rsd.c @@ -84,8 +84,10 @@ static int rsd_read_header(AVFormatContext *s) } par->channels = avio_rl32(pb); - if (!par->channels) + if (par->channels <= 0 || par->channels > INT_MAX / 36) { + av_log(s, AV_LOG_ERROR, "Invalid number of channels: %d\n", par->channels); return AVERROR_INVALIDDATA; + } avio_skip(pb, 4); // Bit depth par->sample_rate = avio_rl32(pb); _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
